y association exists, then the database returns a pointer to the SAD. The deletion of a packet causes the generation from the security gateway toward the source of an ICMP message with the following characteristics: - in the IPv4 environment, Type = 3 (destination unreachable) and Code = 13 (Communication Administratively Prohibited); - in the IPv6 environment, Type = 1 (destination unreachable) and Code = 1 (Communication with Destination Administratively Prohibited). The security parameter index (SPI) is a field in the AH or ESP header used by the destination to identify the security association in a unique way. The destination uses this index to extract the security association parameters from the SAD. SWu Tunnel Establishment For an incoming packet, the SPD is consulted if the packet is not protected, and the instruction (BYPASS or DISCARD) is applied. If the IP packet is protected, then the SPI field is used to recover the parameter of the security association. 7.1.1. Header extensions The IPSec mechanism introduces two IPv4 or IPv6 header extensions: - authentication header (AH) is designed to ensure the integrity and authentication of IP packets without data encryption (no confidentiality); - encapsulating security payload (ESP) ensures the integrity, authentication and confidentiality of IP packets. 7.1.1.1. AH extension The presence of the AH extension is indicated by the Next Header (in IPv6) or Protocol (in IPv4) field of the previous header, with a value of 51. The AH extension contains the following fields (Figure 7.1). Next Header Payload Len RESERVED Security Parameters Index (SPI) Sequence Number Field Integrity Check Value-ICV (variable) Figure 7.1. AH extension format Next Header: this field, coded on one byte, indicates the type of header following the ESP extension. Payload Length: this field, coded on 1 byte, provides the extension size in multiples of four bytes, not including the first eight bytes. The size of the extension in IPv6 must remain a multiple of eight bytes. 128 Wi-Fi Integratio