208 Chapter 13 VPNNN47922-500EncapsulationThe two modes of operation for IPSec VPNs are Transport mode and Tunnelmode.Figure 66 Transport and Tunnel mode IPSec encapsulationTransport modeTransport mode is used to protect upper layer protocols and only affects the datain the IP packet. In Transport mode, the IP packet contains the security protocol(AH or ESP) located after the original IP header and options, but before anyupper layer protocols contained in the packet (such as TCP and UDP).With ESP, protection is applied only to the upper layer protocols contained in thepacket. The IP header information and options are not used in the authenticationprocess. Therefore, the originating IP address cannot be verified for integrityagainst the data.With the use of AH as the security protocol, protection is extended forward intothe IP header to verify the integrity of the entire packet by use of portions of theoriginal IP header in the hashing process.Tunnel modeTunnel mode encapsulates the entire IP packet to transmit it securely. A Tunnelmode is required for gateway services to provide access to internal systems.Tunnel mode is fundamentally an IP tunnel with authentication and encryption.This is the most common mode of operation. Tunnel mode is required for VPNswitch to VPN switch and host to VPN switch communications. Tunnel modecommunications have two sets of IP headers:
