What killed IPsec is that its architecture is just wrong. The IPsec architecture involves authenticating peers and authorizing them to IP addresses. Yes, that

What killed IPsec is that its architecture is just wrong. The IPsec architecture involves authenticating peers and authorizing them to IP addresses. Yes, that's the architecture! See RFC 4301 [0]. That's not good because IP addresses are way to variable. This approach results in configuration hell. No one wants to admin IPsec. Instead IPsec should have bound authenticated IDs into packet flows (e.g., TCP connections) for the duration of those flows (i.e., until the sockets are closed), and these IDs should be exposed to apps (e.g., via socket options) so that applications can perform authorization (based on authenticated IDs) or channel binding into application-layer authentication protocols. IKEv2-authenticated IDs could be ephemeral / anonymous (e.g., raw ephemeral public keys). And these IDs can be bound into authentication at application layers. Now, I am biased -- I wrote an RFC on this subject: RFC 5660 [1]. ESP is a fine protocol. So is IKEv2. What's not fine is the architecture. If instead you bind extant packet flows to authenticated IDs, then the architecture works. Note that this alternative architecture can work with NATs and firewalls because IP addresses aren't relevant in it. And this is very similar to all the non-IPsec VPNs out there, only those others don't use ESP. But there's a benefit to using ESP: it's easier to design hardware to offload ESP than to offload anything else. [0] https://tools.ietf.org/html/rfc4301 [1] https://tools.ietf.org/html/rfc5660