acturers that desired to communicate with each other securely should be able to engage in a handshake mechanism at session establishment time, commu- nicate their cryptographic capabilities and user preferences to each other, and automatically negoti- ate transparently for the user the setup of a session that is configured along a greatest common denominator of capabilities as well as security requirements. The IPsec transport mode is used when upper-layer protocols need to be protected such as UDP or TCP in end-to-end sessions, whereas the tunnel mode is used when complete IP datagrams need to be protected, as is the case in gateway-to-gateway communications where one does not want LAN- internal destination addresses or even specific sessions to be monitored outside while they traverse the WAN. In transport mode, the IPsec header is inserted between the IP header and the upper-layer Downloaded from Digital Engineering Library @ McGraw-Hill (www.digitalengineeringlibrary.com) Copyright © 2004 The McGraw-Hill Companies. All rights reserved. Any use is subject to the Terms of Use as given at the website. SECURITY COPROCESSORS 386 NETWORK PROCESSORS TCP or Original IP packet Payload header header TCP or Protected packet IPsec Payload in transport mode header header header Protected external internal TCP or IPsec Payload Packet in header Tunnel mode header header header FIGURE 17.7 IPsec restructuring of IP packets according to the transport and tunnel modes protocol header. In tunnel mode, the entire packet to be protected is encapsulated inside another data- gram, and an IPsec header is inserted between the outer and inner headers. Figure 17.7 illustrates this. We mentioned earlier the concept of security associations (SAs), which allow the structured han- dling of multiple secure sessions. SAs are unidirectional; therefore, a different SA is used for inbound as opposed to outbound traffic. In the case of IPsec, they are identified by an index called Security Parameter Index (SPI), which is inside each packet and u