TCP/IP Tutorial and Technical Overview - IBM Redbooks

ESP in transport mode
In this mode, the ESP header is inserted right after the IP header, as shown in
Figure 22-29. If the datagram already has IPSec header or headers, the ESP
header is inserted before any of those. The ESP trailer and the optional
authentication data are appended to the payload.
IP H dr
IP H dr
Payload
ESP
Hdr
Encrypted
A uthenticated
Figure 22-29 ESP in transport mode
ESP in transport mode provides neither authentication nor encryption for the IP
header. This is a disadvantage, because false packets might be delivered for
ESP processing. The advantage of transport mode is the lower processing cost.
As in the case of AH, ESP in transport mode is used by hosts, not gateways.
Gateways are not required to support transport mode.
ESP in tunnel mode
As expected, this mode applies the tunneling principle. A new IP packet is
constructed with a new IP header. ESP is then applied, as in transport mode.
This is illustrated in Figure 22-30. Because the original datagram becomes the
payload data for the new ESP packet, it is completely protected if both encryption
and authentication are selected. However, the new IP header is still not
protected.
IP Hdr Payload
New
IP Hdr
New
IP Hdr
Payload
IP Hdr Payload
ESP
Hdr
IP Hdr Payload
Figure 22-30 ESP in tunnel mode
Encrypted
Authenticated
ESP
Trl
ESP
Auth
ESP
Trl
O riginal IP datagram
Datagram with ESP
in transport mode
ESP
Auth
Original IP datagram
Tunneled datagram
Datagram with ESP
in transport mode
Chapter 22. TCP/IP security 821