key exchange. It supports key sizes of varying lengths, depending on the capabilities of each end of the connection. IPsec emphasizes security by authenticating both ends of the connection, negotiating the encryption protocol and key for the encrypted session, and encrypting and decrypting the session establishment data. IPsec provides secure transmission of packets at the IP layer, including authentication and encryption of the packets. This is accomplished by using the authentication header and encapsulating secu- rity payload features of IPsec. IPsec uses transport and tunnel modes. In transport mode, only the IP payload is encrypted. There is no change to the original IP header. This is generally used between hosts or routers and also in client/server VPNs. In tunnel mode, the entire IP datagram is encrypted; the original packet is encapsulated in IPsec and given a new IP header. This mode is generally used between gateways. IPsec and IKE in IPv4 and IPv6 Internet Key Exchange (IKE), which is defined in RFC 2409, is the key exchange protocol that IP Security (IPsec) uses in computers that need to negotiate security associations- that is, connections between systems, established for the purpose of securing the packets transmitted across the connections-with one another. Although IPsec is optional in IPv4, in IPv6, providing security through IPsec and, in turn, IKE is mandatory. With IKE, public key techniques are used to mutually authenticate the communicat- ing parties. IKE supports both digital certificates and preshared keys for authentication. IKE uses a Diffie-Hellman key exchange to set up a shared session secret from which the bulk cryptographic keys are derived. If you use preshared keys, then every node must be linked to every other node by a unique key, and the number of keys needed can grow out of control (e.g., two devices need 1 key, and eight devices need 28 keys). That's why most production implementations of IPsec use digital certificates issued most often by internal certificate authorities. I