TCP/IP Tutorial and Technical Overview - IBM Redbooks

The tunnel mode is used whenever either end of a Security Association is a
gateway. Therefore, between two firewalls the tunnel mode is always used.
Gateways often also support transport mode. This mode is allowed when the
gateway acts as a host, that is, in cases when traffic is destined to the gateway
itself. For example, SNMP commands can be sent to the gateway using transport
mode.
In tunnel mode the outer header's IP addresses does not need to be the same as
the inner headers' addresses. For example, two security gateways can operate
an ESP tunnel that is used to secure all traffic between the networks they
connect together. Hosts are not required to support tunnel mode.
The advantages of tunnel mode are total protection of the encapsulated IP
datagram and the possibility of using private addresses. However, there is an
extra processing charge associated with this mode.
IPv6 considerations
As with AH, ESP is an integral part of IPv6 (see 9.2.1, “Extension headers” on
page 333). In an IPv6 environment, ESP is considered an end-to-end payload
and it appears after hop-by-hop, routing, and fragmentation extension headers.
The destination options extension header(s) could appear either before or after
the AH header. Figure 22-31 illustrates the positioning of the AH header in
transport mode for a typical IPv6 packet. The position of the extension headers
marked with an asterisk (*) is variable, if present at all.
For more details, refer to RFC 2406.
Ext. Hdr
IP Hdr hop, dest*,
routing, frag
Figure 22-31 ESP in transport mode for IPv6
Two authentication protocols
Knowing about the security services of ESP, you might ask if there is really a
requirement for AH. Why does ESP authentication not cover the IP header as
822 TCP/IP Tutorial and Technical Overview
ESP
Hdr
Dest
options*
Payload
Encrypted
Authenticated
ESP
Trl
ESP
Auth