VPNs are a funny old thing and it's great to see a new tool to add to the toolbox. IPSEC is quite hard to deal with. For starters you have to understand that

VPNs are a funny old thing and it's great to see a new tool to add to the toolbox. IPSEC is quite hard to deal with. For starters you have to understand that IPSEC was designed quite a while back and not only to shuffle TCP/IP (or UDP/IP). Nor is bog standard IPSEC "routing" in the IP sense. Those Phase 2 thingies are "selectors" - they look for attributes in a packet (generally left and right IP subnets) and then take action. Those selectors could be SPX/IPX addresses instead or people's family names if that makes sense for the system. Now, your P1 is the auth bit. It can accept many (err several) mechanisms but in general its PSK or certs. Then there is the identification thing - you pass your ID (which can be "lol, anyone, I'm pretty!") P1: You say Hi and state your ID and if you get a response with an ID then you try to authenticate. You send your methods and they send theirs. You pick an intersection of your offering and theirs and give it a go. With luck you get it right and you now have a relationship between you and the other end. That relationship is called a Security Association (SA) P2: This is called the Security Policy (Database). Network packets are inspected by the IPSEC engine looking for certain characteristics. In general it is IP subnet pairs - it doesn't have to be - remember IPSEC had much bigger goals than just IP. You send data and the other end decrypts it. I have not really done IPSEC justice here because it is quite beautiful as a standard. It is quite complete and the vendors and implementations have really fucked up. It is understandable in some cases because encryption does have a cost. In the end IPSEC is still the most employed VPN standard and also the worst understood. Sad really.