IPsec

In the Ultra Transcenders books

AZ-700

Each book explains IPsec in context, with comparison tables and the common traps.

Terms in this definition

• Set

  Secret permission in Key Vault for writing secrets; some older material refers to it as Create.

Related terms

• AH

  Short for Authentication Header, an IPsec protocol that verifies the sender and integrity of an entire IP packet but leaves it unencrypted. Network security group rules can filter on it, as they can on TCP, UDP, ICMP and ESP.

• Connection

  Resource that attaches a virtual network gateway to its peer, which may be an ExpressRoute circuit, a second VNet gateway (Vnet2Vnet) or a local network gateway over IPsec. Resetting it recovers a single tunnel and avoids rebooting the whole gateway.

• Connection security rules

  IPsec rules in the advanced Windows firewall that authenticate and protect machine-to-machine traffic, so normal firewall rules may then permit secured connections only.

• Custom IPsec/IKE policy

  Set of algorithms for IKE Phase 1 and IPsec Phase 2, together with DH and PFS groups and SA lifetimes, applied to one connection rather than the gateway; each connection takes one policy, and every parameter has to be filled in.

• Domain isolation

  A Windows Firewall design built on IPsec connection security rules, in which computers joined to the domain take traffic only from fellow members that have authenticated.

• ESP

  The IPsec protocol responsible for encrypting a packet's payload. Network security group rules can filter on it as a protocol.

• IKE

  Negotiates keys for IPsec tunnels. Site-to-site VPN connections in Azure rely on it together with IPsec, and Basic policy-based gateways support only the older IKEv1.

• IKEDiagnosticLog

  A VPN Gateway resource log giving detailed IKE and IPsec negotiation information, including SAs, proposals and PSK failures. Check it first when a tunnel fails to come up or repeatedly drops.