TLS vs IPsec
TLS operates at the session layer above TCP/SCTP; IPsec operates at the network layer. Both encrypt, both authenticate, but their operational fit for telecom signaling differs by interface.
| Attribute | TLS | IPsec |
|---|---|---|
| Layer | Session (above transport) | Network (IP) |
| Typical telecom use | SBA (HTTP/2), N32, RESTCONF | Diameter (S6a), S1-MME backhaul, IPX tunnels |
| Endpoint granularity | Per NF service instance | Per network endpoint / gateway |
| Key rotation | Session-level, easy | IKE rekey, coarser |
| Observability | Session-scoped, per-request | Tunnel-scoped, less granular |
Verdict
IPsec fits site-to-site trust and legacy Diameter well. TLS fits SBA and any interface that terminates per service call. Roaming demands both — IPsec at the IPX edge and TLS at N32 / SBA — because each layer covers a different threat.