TCP/IP Tutorial and Technical Overview - IBM Redbooks

Note: ESP authentication data was not present in early implementations of
the IBM firewall.
IP Hdr ESP Inner Payload
ESP
AH
Hdr IP Hdr
Trl
Figure 22-34 Combined AH-ESP tunnel
Case 3: End-to-end security with VPN support
This case is a combination of cases 1 and 2 and does not raise new IPSec
requirements for the machines involved (see Figure 22-35). The big difference
from case 2 is that now the hosts are also required to support IPSec.
H1 intranet G1 Internet/
intranet
G2 intranet
H2
Connection IPSec tunnels
Figure 22-35 End-to-end security with VPN support
In a typical setup, the gateways use AH in tunnel mode, while the hosts use ESP
in transport mode. An enhanced security version might use a combined AH-ESP
tunnel between the gateways. In this way, the ultimate destination addresses are
encrypted; the whole packet traveling the Internet would be authenticated and
the carried data double encrypted. This is the only case when three stages of
IPSec processing might be useful, however, at a cost—the performance impact
is considerable.
AH tunneling of ESP transport
Let us look in more detail at the common combination of using AH tunneling to
protect ESP traffic in transport mode.
Chapter 22. TCP/IP security 827