CertiGuide to Security+  9  Chapter 2:  Communication Security (Domain 2.0; 20%)       9  2.1  Remote Access            9  2.1.7  IPSEC

IPSec Packet Types 1 IPSec and Encryption

IPSec supports Transport and Tunnel modes for encryption. The “Transport” mode encrypts only the data portion of the encapsulated packet, while the “Tunnel” mode encrypts both the data and the header portions of the encapsulated packet hiding more information about the underlying communications¹⁵⁹.

A typical transport-mode packet looks like Figure 19.

The “Tunnel” mode is most commonly used to encapsulate existing IP traffic for communication between hosts on networks connected by IPSec-enabled routers. With routers doing the IPSec encapsulation, no changes are required to software or drivers on the hosts – the IPSec encryption is effectively transparent.

A typical tunnel-mode packet looks like Figure 20.

The flexibility of IPSec provides for connecting multiple sites in secure VLAN using VPN technologies, or a road warrior to connect in transport mode where the road warrior doesn’t have control over a router and the tunneling mode would fail. Because IPSec creates an SA for both sending and receiving, each SA can be a different mode.

For a concise, clear explanation of IPSec on Windows 2000 networks, check out Configuring Windows 2000 Server Security¹⁶⁰.

IPSec Packet Types 1 IPSec and Encryption