TCP/IP Tutorial and Technical Overview - IBM Redbooks

AH in transport mode
In this mode, the authentication header is inserted immediately after the IP
header, as shown in Figure 22-25. If the datagram already has IPSec headers,
the AH is inserted before them.
IP Hdr Payload
IP Hdr AH Payload
Figure 22-25 Authentication Header in transport mode
Transport mode is used by hosts, not by gateways. Gateways are not required to
support transport mode.
The advantage of transport mode is fewer processing costs. The disadvantage is
that mutable fields are not authenticated.
AH in tunnel mode
With this mode, the tunneling concept is applied, a new IP datagram is
constructed and the original IP datagram is made the payload of it. AH in
transport mode is applied to the resulting datagram. See Figure 22-26 for an
illustration.
Ext. Hdr(s)
IP Hdr hop, dest*,
routing, frag
Figure 22-26 Authentication Header in tunnel mode
Tunnel mode is used whenever either end of a Security Association is a
gateway. Therefore, between two firewalls, tunnel mode is always used.
816 TCP/IP Tutorial and Technical Overview
Authenticated
(except mutable fields)
AH
Original IP datagram
Dest
options*
Authenticated
(except mutable fields)
Datagram with AH
in transport mode
Payload