Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

In IPSec, why does it make sense to differentiate between Security Associations and Security policies?

share|improve this question
up vote 2 down vote accepted

I always liked that definition from tcpipguide

Security Policies:

A security policy is a rule that is programmed into the IPSec implementation that tells it how to process different datagrams received by the device. For example, security policies are used to decide if a particular packet needs to be processed by IPSec or not; those that do not bypass AH and ESP entirely. If security is required, the security policy provides general guidelines for how it should be provided, and if necessary, links to more specific detail.

Security policies for a device are stored in the device's Security Policy Database (SPD).

Security Associations:

A Security Association (SA) is a set of security information that describes a particular kind of secure connection between one device and another. You can consider it a "contract", if you will, that specifies the particular security mechanisms that are used for secure communications between the two.

A device's security associations are contained in its Security Association Database (SAD).

The former says that if you see a packet that looks like it has characteristics X do Y. The latter says that with this host we talk IPSec in this ways.

Might help if you think of it as stateless and statefull, respectively.

share|improve this answer

An SA also can (should) have a lifetime such as number of packets, minutes etc. Before the SA expires, a new SA is created, using a new key negotiated by IKE.

The more cypher text encrypted using the same key increases the chance of a Ciphertext Only Attack

Also if the key is broken, only a portion of the traffic is compromised.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.