What is ESP and AH protocols?

ESP uses HMAC-MD5, HMAC-SHA, HMAC-SHA-256, HMAC-SHA-384, HMAC-SHA-512, and AES-XCBC-MAC algorithms to provide authentication functions. Each of the algorithms take variable-length input data and a secret key to produce fixed-length output data (called a hash or MAC value).

IPSec uses two distinct protocols, Authentication Header (AH) and Encapsulating Security Payload (ESP) , which are defined by the IETF. The AH protocol provides a mechanism for authentication only. AH provides data integrity, data origin authentication, and an optional replay protection service.

ESP (Encapsulating Security Payload) is the most common protocol for encapsulation of the actual data in the VPN session. ESP is IP Protocol 50, so is not based TCP or UDP protocols . Because of this, NAT devices often have a problem with ESP (read on for more on this).

ESP (Encapsulating Security Payload) ESP is used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service (a form of partial sequence integrity), and limited traffic flow confidentiality .