2 cissp ® Official Study Guide Eighth Edition

IP Security Protocol
The most commonly used VPN protocol is now IPsec. 
IP Security (IPsec)
is both a stand-
alone VPN protocol and the security mechanism for L2TP, and it can be used only for IP 
traffic. IPsec consists of the security elements of IPv6 crafted into an add-on package for 
IPv4. IPsec works only on IP networks and provides for secured authentication as well as 
encrypted data transmission. IPsec has two primary components, or functions:
Authentication Header (AH)

AH provides authentication, integrity, and nonrepudiation.

Encapsulating Security Payload (ESP)

ESP provides encryption to protect the confiden-

tiality of transmitted data, but it can also perform limited authentication. It operates at the 
Network layer (layer 3) and can be used in transport mode or tunnel mode. In transport 
mode, the IP packet data is encrypted but the header of the packet is not. In tunnel mode, 
the entire IP packet is encrypted and a new header is added to the packet to govern trans-
mission through the tunnel.
Table 12.1 illustrates the main characteristics of VPN protocols.
TA b l e 12 .1
VPN characteristics
VPN 
Protocol
Native 
Authentication 
Protection
Native Data 
Encryption
Protocols 
Supported
Dial-Up Links 
Supported
Number of 
Simultaneous 
Connections
PPTP
Yes
No
PPP
Yes
Single point-
to-point
L2F
Yes
No
PPP/SLIP
Yes
Single point-
to-point
L2TP
Yes
No (can use 
IPsec)
PPP
Yes
Single point-
to-point
IPsec
Yes
Yes
IP only
No
Multiple
The VPN protocols which encapsulate PPP are able to support any subprotocol compatible with PPP, which 
includes IPv4, IPv6, IPX, and AppleTalk.

---

Virtual Private Network 
545
A VPN device is a network add-on device used to create VPN tunnels separately from 
server or client OSs. The use of the VPN devices is transparent to networked systems.