 in Figure 6.22. The original IP packet is encapsulated into a GRE packet. The GRE packet itself is encapsulated into an IP packet. This means an IP packet is transported inside an IP packet. The outer IP packet is forwarded like an ordinary IP packet within an IP network. Understanding Changing Telecommunications - Building a Successful Telecom Business Original packet UPD/TCP Payload GRE Tunnelling UPD/TCP Payload Unprotected data GRE Checksum coverage protection Figure 6.22 The GRE tunnelling principle 6.11.3 SECURITY IN REMOTE ACCESS Secure shell (SSH) is a protocol that permits secure remote access over a network between two computers. The protocol negotiates and establishes an encrypted connection between what is called an SSH client and an SSH server. The SSH protocol consists of three major components: Transport layer protocol. This protocol provides server authentication, confidentiality and integrity. User authentication protocol. This protocol authenticates the client to the server. Connection control. This protocol multiplexes the encrypted tunnel onto several logical channels. SSH can handle several data streams over the same TCP connection. 6.12 CONFIDENTIALITY AND INTEGRITY BY IPsec The Internet protocol security (IPsec) provides a set of protocols and a robust mechanism to provide security to the Internet protocol (IP). The protocol is a cornerstone when building VPNs. IPsec forms a secure layer from one network node to another, protecting all IP packets concerned at the IP layer (it does not protect individual applications from attacks). It is rather an extensive standard, which has become part of the IPv6 standard. For IPv4 it is optional. IPsec provides: Confidentiality Integrity Authenticity Non-replay protection Different IPsec security levels are available through various modes and security proto- cols. IPsec can be used in two modes: Transport mode (not common) Tunnel mode Security Security gateway Ipsec tunnels Security gateway Figure 6.23 IPsec tunnels starts and ends at security gateways