Symantec™ Security Gateways Reference Guide - Sawmill

Understanding VPN tunnelsIPsec standard93Figure 7-4 shows the difference in structure between a standard IP datagram, an IP datagram in transportmode, and an IP datagram in tunnel mode.Figure 7-4Transport and tunnel modesData integrity protocolThe data integrity protocol defines what portion of the IP datagram to use when calculating and verifyingits authenticity. The security gateway supports two different protocols, AH and ESP, to protect either theentire IP datagram, or just the upper-layer portion.Authentication header (AH)AH provides authentication, integrity, and replay protection to the entire IP datagram. AH achieves this bycalculating an integrity check value (ICV) based on content that should not change during transit. AH thenpositions its own header between the packet’s IP header and payload, announcing to the remote systemthat AH is in use. When the packet arrives at the remote system, the ICV is again recalculated, andcompared to the original ICV. If the values do not match, the packet is discarded. Figure 7-5 shows anexpanded view of the AH header.Figure 7-5AH-protected IP datagram with expanded AH header