IPsec VPNs (AH vs ESP), WPA3 wireless, and converged networks

IPsec architecture: IKE, AH vs ESP, and Transport vs Tunnel mode

IPsec (Internet Protocol Security) is a suite of open IETF standards that secures network communications at OSI Layer 3, making it transparent to applications running at Layer 7. Setting up an IPsec VPN relies on Internet Key Exchange (IKEv2, UDP ports 500 and 4500 for NAT-Traversal) in two phases: IKE Phase 1 authenticates the peers (via pre-shared keys or X.509 certificates) and runs Diffie-Hellman to establish a bidirectional management tunnel (IKE SA); IKE Phase 2 negotiates the fast, unidirectional IPsec Security Associations (SAs, tracked by a 32-bit Security Parameter Index, or SPI) that carry actual data.

IPsec offers two core security protocols: Authentication Header (AH) and Encapsulating Security Payload (ESP). AH provides connectionless integrity, data origin authentication, and anti-replay protection across the entire packet (including immutable fields of the outer IP header), but AH provides ZERO encryption (no confidentiality) and fails whenever packets cross a Network Address Translation (NAT) device because NAT modifies the IP address that AH signed. ESP provides confidentiality (encryption via AES), data origin authentication, connectionless integrity, and anti-replay protection, and works cleanly with NAT-Traversal (NAT-T).

Each IPsec SA operates in one of two modes. Transport Mode encrypts and/or authenticates only the IP payload while leaving the original IP header intact in plaintext (used for end-to-end host-to-host communication inside a datacenter). Tunnel Mode wraps and encrypts the entire original IP packet (both original IP header and payload) and prepends a brand-new outer IP header bearing the IP addresses of the two VPN gateways (the standard choice for site-to-site and remote-access VPNs).

Wireless security: from WEP and WPA2-CCMP to WPA3-SAE and 802.1X

Because 802.11 Wi-Fi broadcasts frames over shared radio spectrum, IEEE wireless security evolved through four generations. WEP (Wired Equivalent Privacy) used the stream cipher RC4 with a tiny 24-bit Initialization Vector (IV) and a non-cryptographic CRC-32 checksum, allowing attackers to recover the key in minutes via IV collisions. WPA (Wi-Fi Protected Access) was an interim patch using TKIP (Temporal Key Integrity Protocol) on legacy RC4 hardware and is now deprecated.

WPA2 mandated AES-CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code). WPA2 operates in two authentication modes: WPA2-Personal (PSK, where every user shares one passphrase; if an attacker captures the 4-way handshake via a deauthentication frame, they can run an offline dictionary attack against the passphrase) and WPA2-Enterprise (which uses IEEE 802.1X and RADIUS so every user/device gets a unique session key).

WPA3 fixes the weaknesses of WPA2: in WPA3-Personal, the vulnerable 4-way PSK handshake is replaced by SAE (Simultaneous Authentication of Equals, the "Dragonfly" key exchange), which blocks offline dictionary cracking and provides Perfect Forward Secrecy. WPA3-Enterprise offers 192-bit cryptographic suite options (GCMP-256), and WPA3 mandates IEEE 802.11w Protected Management Frames (PMF) to stop attackers from spoofing deauthentication/disassociation packets to knock users onto an Evil Twin rogue access point.

Converged networks: VoIP (SIP/SRTP), SDN, and storage protocols

Modern enterprise networks converge voice, storage, and management onto IP fabrics. Voice over IP (VoIP) uses SIP (Session Initiation Protocol) to set up and tear down calls and RTP (Real-time Transport Protocol) to stream audio. Unencrypted VoIP is vulnerable to vishing, call hijacking, and eavesdropping; Kael Cho isolates VoIP phones onto a dedicated Voice VLAN, enforces SIPS (SIP over TLS) for signaling and SRTP (Secure RTP) for voice encryption, and blocks rogue DHCP/TFTP option injection.

In Software-Defined Networking (SDN), the Control Plane (the centralized SDN controller making routing decisions) is decoupled from the Data/Forwarding Plane (the switches forwarding packets) and the Management/Application Plane. Because the SDN controller is a single point of failure and high-value target, its northbound and southbound APIs must be isolated on an out-of-band management network and authenticated via mTLS.