Explain IPsec transport mode versus tunnel mode.
Show the answer
Say this first
Tunnel mode protects the entire original IP packet and puts it behind a new IP header that carries the gateway addresses. Transport mode keeps the original IP header and protects only what follows it. Gateways protecting traffic for other hosts use tunnel mode. Transport mode is for host-to-host protection, or when another protocol such as GRE has already added the outer header.
Go deeper
On the wire
Original: [IP 10.1.0.10 > 10.2.0.20][TCP][data]
Tunnel mode: [IP 198.51.100.1 > 203.0.113.2][ESP][IP 10.1.0.10 > 10.2.0.20][TCP][data][trailer][ICV]
Transport mode: [IP 10.1.0.10 > 10.2.0.20][ESP][TCP][data][trailer][ICV]
GRE over IPsec,
transport mode: [IP 198.51.100.1 > 203.0.113.2][ESP][GRE][IP 10.1.0.10 > 10.2.0.20][TCP][data][trailer][ICV]What changes
- Tunnel mode hides the real source and destination; an observer only sees the two gateways.
- Transport mode exposes the real addresses but saves 20 bytes.
- On IOS a transform set is tunnel mode unless you add
mode transportunder it.
They will ask next
Which mode does a static VTI use?
Tunnel mode. The outer header carries the tunnel source and destination, and the traffic selectors are any to any.
Why can two gateways not protect their LANs with transport mode?
In transport mode the packet keeps the host addresses as its only IP header. It would be routed to the remote host directly instead of to the remote gateway, which is the only device that can decrypt it. Tunnel mode adds the gateway-to-gateway header that delivers it.
Traps
- Saying transport mode does not encrypt the payload. It encrypts everything after the IP header.