the LDAP directory. 6.11 CONFIDENTIALITY BY TUNNELLING There are many definitions of a tunnel: A tunnel is a safe point-to-point connection over an unsecure network, but can also be seen as an emulated connection-oriented connection over a connectionless network. Furthermore, tunnelling is an enabler for encapsulating packets (of different types such as IP, IPX) inside a common infrastructure. Even better is to regard the tunnel as an overlay network creating for example a corporate wide area network within a public IP network. Tunnelling simplifies life for the routers along the path, since they do not have to under- stand all tunnelled encapsulated protocols. Layers 2 and 3 are employed for tunnelling. Tunnelling is used for: designing and setting up a VPN remote access to companies interworking between IPv4 and IPv6 numbering supporting host mobility, such as mobile IP (RFC 2002) private numbering plan (compare VPN in PSTN/ISDN with public and private numbers) multiplexing several protocols into one link carrying other protocols than IP across the IP network creating a dedicated overlay backbone (e.g. MBONE and other tunnels for multicast). The use of tunnels ensures that the tunnelled traffic may not exit from the tunnel. However, it is still possible for malicious users on the path between the tunnel end points to listen and inspect all the tunnelled payload traffic. It is also possible for an attacker to insert packets into a tunnelled stream. Since the packet content is normally encrypted it is, however, difficult to understand what is transferred. The lower part of Figure 6.21 shows layer 3 tunnelling with basic IP and transport protocols encapsulated by 'IPsec' and a new IP header, existing between IPsec gateways. The upper part of the figure shows an alternative to tunnelling, defined in the IPsec standard. See below. There are two main parts of a tunnelling protocol: setting up the tunnel (and tearing it down) encapsulating one protocol in another The tunnel technique has proven reliable. To provide a 