CRIPTOGRAFIA - FESP

ESP in Tunnel Mode
Our final look of standalone ESP is in Tunnel mode, which encapsulates an entire
IP datagram inside the encrypted shell:
Providing an encrypted Tunnel Mode connection is getting very close to the
traditional VPN that springs to mind when most of us think about IPsec, but we
have to add authentication of one type or another to complete the picture: this is
covered in the following section.
Unlike AH, where an onlooker can easily tell whether traffic is in Tunnel or
Transport mode, this information is unavailable here: the fact that this is Tunnel
mode (via next=IP) is part of the encrypted payload, and is simply not visible to
one unable to decrypt the packet.