IPSec + SASE

Authentication Header (AH)

provides a mechanism for authentication only. Because AH does not perform encryption, it is faster than ESP

ESP (Encapsulating Security Payload)

provides data confidentiality (encryption) and authentication (data integrity, data origin authentication, and replay protection). ESP can be used with confidentiality only, authentication only, or both confidentiality and authentication

In transport mode

the IP addresses in the outer header are used to determine the IPsec policy that will be applied to the packet. It is good for ESP host-to-host traffic

In tunnel mode

two IP headers are sent. The inner IP packet determines the IPsec policy that protects its contents

Secure Access Service Edge (SASE)

A networking model that merges traditional WAN management and security capabilities into a unified whole. SASE is built, implemented, and managed using cloud-native architectures. SASE is a response to the edge-centric trends in mobility, cloud, SD-WAN and the internet of things.