How IPSEC VPN work

IPSEC is a group of protocols

Sets up secure tunnels over insecure networks
Provides Authentication and At Rest
SA - Security Associations. An SA is a relationship between two or more entities that describes how the entities will use security services to communicate securely.

Has two phases

IKE Phase 1 (Slow and Heavy)
Authenticate - Pre-shared key (Password) / Certificate
Uses Asymmetric encryption to agree on, and create a shared Symmetric key
Diffie–Hellman key exchange - Wikipedia
IKE SA Created (phase 1 tunnel)

IKE Phase 2 (Fast and Agile)
Uses the keys agreed in phase 1
Agree on encryption method and key for data trans
Create IPSEC SA … phase 2 tunnel (runs over phase 1)

VPN Types

Policy-based
rule set match traffic and traffic sent over a pair of SA
different rules/sec settings
Route-based
based on route target (prefix) match
matches a single pair of SAs