contain a full IP packet in the tunnel mode. In the transport mode the ESP header's payload contains destination options, transport layer protocol and the payload of the transport layer protocol. The AH header is always inserted between the external header and the encapsulated packet in the case of tunnel mode, and before the destinations options header in the case of transport mode. Figure 3.21 illustrates how the AH and ESP headers are located in both transport and tunnel modes. 3.8.2 Security Associations A decision as to which traffic IPsec processing should be performed is based on Security Associations (SAs), which may have been set up with IKEv2. An SA, identified by a Security Parameters Index (SPI), is set up for one direction and it describes to which destination address (or destination and source address) the SPI applies, whether AH or ESP is to be used, what is the next layer protocol that the SA relates to, which keys are used, and to which Traffic Class the SPI applies. The SA is stored in a Security Association Database (SAD). It is important to note that two security associations, one for each direction, are needed for protecting bi-directional traffic. Next header Payload length Reserved Security Parameters Index (SPI) Sequence Number Field Integrity Check Value (ICV) - variable length Figure 3.19 Authentication header. Deploying IPv6 in 3GPP Networks Security Parameters Index (SPI) Sequence Number Field Payload data (variable length) Padding (0-255 bytes) Padding length Next header Integrity Check Value (variable length) Figure 3.20 Encapsulating security payload header. AH and ESP in transport mode: AH and ESP in tunnel mode: Payload Payload Payload Payload Figure 3.21 AH and ESP header placement illustrative example. 3.8.3 Key Management All security services provided by the IPsec require distribution of keys. The distribution can be manual, which does not scale very well, or performed by a key management protocol. The scalability issues related to manual key distribution and lack of globally 