IPsec vs S2S VPN
Understand how IPsec and site-to-site VPNs differ, where they overlap, and how to choose the right secure tunnel.
People often compare IPsec and S2S VPN as if they are competing technologies. In practice, they describe different layers of the same idea: IPsec is a security protocol suite, while S2S, or site-to-site, is a VPN architecture that connects two networks.
The short answer
IPsec is how traffic is secured. Site-to-site VPN is what is being connected. A site-to-site VPN often uses IPsec underneath, but the two terms are not interchangeable.
What is IPsec?
IPsec, short for Internet Protocol Security, is a set of protocols used to protect IP traffic. It can provide encryption, authentication, integrity checking, and anti-replay protection. IPsec commonly works with IKE or IKEv2 to negotiate keys and tunnel settings between two endpoints.
In simple terms, IPsec answers questions such as:
- How is the traffic encrypted?
- How do both sides prove their identity?
- Which algorithms and keys are used?
- How is packet integrity protected?
What is a site-to-site VPN?
A site-to-site VPN connects two separate networks over an untrusted network, usually the internet. For example, it might connect a head office to a branch office, a data centre to a cloud VPC, or two cloud environments.
A site-to-site VPN answers a different set of questions:
- Which networks should be connected?
- Which routes should pass through the tunnel?
- Which gateways terminate the VPN?
- Should routing be static or dynamic?
Where they overlap
Most traditional site-to-site VPNs use IPsec because it is widely supported by firewalls, routers, cloud providers, and security appliances. In that setup, the site-to-site VPN is the design, and IPsec is the mechanism used to secure the tunnel.
For example, an AWS VPN connection to an office firewall is a site-to-site VPN. The encryption and negotiation are usually handled by IPsec and IKE.
Key differences
| Aspect | IPsec | Site-to-site VPN |
|---|---|---|
| Meaning | Security protocol suite | Network-to-network VPN architecture |
| Purpose | Encrypts and authenticates IP traffic | Connects two private networks |
| Layer of concern | Security and packet protection | Connectivity, routing, and topology |
| Common use | Used by VPNs, remote access, and tunnel designs | Used for branch, cloud, and data centre connectivity |
| Relationship | Can power a site-to-site VPN | Often built using IPsec |
Can S2S use something other than IPsec?
Yes. While IPsec is the classic choice, a site-to-site design can also be built using other technologies depending on the environment. Examples include WireGuard, GRE with encryption, SD-WAN overlays, private circuits, or cloud-native interconnect services.
That said, IPsec remains one of the most common options because it is mature, standards-based, and supported across many vendors.
Which one should you choose?
If your goal is to connect two networks securely, you are probably designing a site-to-site VPN. If you are selecting the encryption and authentication method for that tunnel, you are likely choosing IPsec.
For most business network connections, the practical answer is not IPsec or S2S. It is usually site-to-site VPN using IPsec.
Final takeaway
IPsec and site-to-site VPN are closely related, but they are not direct alternatives. IPsec is the security technology. Site-to-site VPN is the connectivity pattern. Understanding that distinction makes VPN design, troubleshooting, and vendor documentation much easier to follow.