 the IP header changes value. The set of IPv4 header options is considered as a single entity. Some options can be modified by an intermediary router. If a single modifiable option appears, then the set of options is set at ZERO for the authentication digest calculation. The variable fields of the IPv6 header are set at ZERO for the authentication digest calculation. These are identical fields to the ones in the IPv4 header (DSCP, ECN and Hop Limit), as well as the Flow Label field. The Hop-by-Hop and Destination extensions of the IPv6 header have a bit that indicates whether the option can be modified by an intermediary router or not. If this bit is set at ONE, then the extension is set at ZERO for the authentication digest calculation. When the ESP header is used in transport mode, the confidentiality service is applied to the encapsulated data and ESP tail. Authentication and integrity services cover the ESP header, encapsulated data and ESP tail (Figure 7.4). SWu Tunnel Establishment Source IPv4 packet IPv4 header + options Transport mode IPv4 header + options ESP header ESP tail Confidentiality Tunnel mode Authentication and integrity New IPv4 header + options ESP header IPv4 header + options ESP tail Confidentiality Authentication and integrity Source IPv6 packet IPv6 header Extensions Transport mode IPv6 header Extensions SPheader ESP tail Confidentiality Tunnel mode Authentication and integrity New IPv6 header Extensions ESP header IPv6 header Extensions ESP tail ICV Confidentiality Authentication and integrity Figure 7.4. Position of ESP extension When the ESP header is used in tunnel mode, the confidentiality service is applied to the source IP packet and ESP tail. Authentication and integrity services cover the ESP header, source IP packet and ESP tail (Figure 7.4). Note that in transport mode, the Destination extension can appear before, after or simultaneously before and after the AH or ESP extension. 7.1.2. IKEv2 protocol The IKEv2 protocol is more simplified than the previous version. It combines t