 or hosts Transport Application New headers IPsec Payload data Figure 6.24 The encapsulation of the original IP packet into a tunnel The tunnel mode allows an IPsec entity to encapsulate, encrypt and forward IP packets through a logical point-to-point tunnel to another IPsec entity. The tunnel mode encapsu- lates the entire IP header and the payload. See Figures 6.23 and 6.24. The tunnel mode is normally used between two machines when at least one of machines is not an end point of the connection. For example, IPsec in the tunnel mode can be deployed between two firewalls located between a client and a server. The major advantage of the tunnel mode is that an attacker can only determine the tunnel end points and not the true source and destination of the tunnelled packets. Thus the tunnel mode protects against traffic analysis. Another advantage of the tunnel mode is that if offers tunnelling of IP packets with private IP addresses in IP packets with public IP addresses. Thus, the IPsec tunnel mode offers some solutions to the addressing problem. 6.12.1 TRANSPORT MODE The transport mode (Figure 6.25) should primarily be used between the end points of a connection (hosts). It encapsulates and encrypts only the data portion (payload) of each IP packet, but leaves the header untouched. The transport mode is less secure than the tunnel mode, since it does not conceal or encapsulate the IP control information and does not provide traffic flow confidentiality by hiding the source and destination of the IP packet. Understanding Changing Telecommunications - Building a Successful Telecom Business Transport Application New header IPsec Payload data Figure 6.25 The transport mode IPsec uses two protocols to provide traffic security: Authentication header (AH) Encapsulating security payload (ESP) AH and ESP supply partly the same functionality, but ESP is broader and includes encryption methods for IP payload and (in the tunnel mode) for a part of the IP header. AH is described in RFC 2402 and ESP is described in RFC 2406. 