our company integrates with some other companies and we do this using simple TCP connections to a single host+port. most of the companies for some reason use IP

our company integrates with some other companies and we do this using simple TCP connections to a single host+port. most of the companies for some reason use IPSEC and it is always a massive frustration to get stuff working. if you have a failure before phase 1 is negotiated you generally have no idea what is wrong. generally it is either because a) the other side has not configured their firewall or b) there is some kind of mismatch in the phase 1 parameters. however, it is generally impossible to tell which one it is because either IPSEC protocol doesn't support status messages or it is not configured because of 'security' to generate status messages. also, in the case where there is a mismatch apparently it is very difficult for the operators at the other end to extract the information from the logs about what is wrong :/ you get a similar problem with phase 2. if there is something wrong the setup will just fail and you will only know there is a problem with phase 2 but not the reason why. compare this with TLS and I can generally identify what the problem with a failed handshake is from either the status messages or by looking at the client/server hello. IPSEC is also more a pain to deploy than TLS. for TLS protected connections we just whitelist 2 IPs and run our integration on two boxes for high availability. really simple. for IPSEC now we either have two buy two pieces of expensive CISCO hardware to give us a HA VPN connection or we need to duct-tape up two strongswan boxes with automated failover to give us HA. not fun. i understand why people might want to use IPSEC if they want to encrypt all the traffic between two networks transparently. but for encrypting individual point-to-point connections it is massively overkill. i suspect people end up using IPSEC for point-to-point encryption because they see it as difficult to add TLS support to existing software but don't know about options like stunnel (https://www.stunnel.org/ https://www.stunnel.org/).