IPsec

IPsec (Internet Protocol Security), defined by RFC 4301, is a suite of protocols that authenticates and encrypts IP packets to secure communication at the network layer. Because it operates below the application, it protects traffic transparently — applications and APIs riding on top gain confidentiality and integrity without needing to change their own code.

• Authentication Header (AH) and Encapsulating Security Payload (ESP) - The two core protocols providing packet authentication and, in ESP’s case, encryption.
• Tunnel and transport modes - Tunnel mode wraps entire packets for site-to-site VPNs, while transport mode secures the payload between two endpoints.
• Internet Key Exchange (IKE) - The negotiation protocol that authenticates peers and establishes the shared security associations and keys.
• Network-layer scope - Security applied to all IP traffic between endpoints, independent of the applications generating it.

In API operations IPsec most often shows up as the encrypted tunnel connecting data centers, cloud VPCs, and partner networks — the private rail that backend services and internal APIs communicate over before traffic ever reaches a public gateway. While application-layer TLS secures the client-to-API hop, IPsec is frequently the layer securing the machine-to-machine and site-to-site links behind it, a distinction that matters as agent-driven systems push more sensitive traffic across hybrid and multi-cloud networks.