NB8WVPN User Guide
YML8WVPN
www.netcomm.com.au
Transport Mode
The transport mode IPSec implementation encapsulates only the packet’s payload. The IP header is not changed.
After the packet is processed with IPSec, the new IP packet contains the old IP header (with the source and
destination IP addresses unchanged) and the processed packet payload.
The tunnel mode IPSec implementation encapsulates the entire IP packet.
The entire packet becomes the payload of the packet that is processed with IPSec. A new IP header is created that
contains the two IPSec gateway addresses. The gateways perform the encapsulation/decapsulation on behalf of
the hosts. Tunnel mode ESP prevents an attacker from analyzing the data and deciphering it, as well as knowing
who the packet is from and where it is going.
Key Management
IPSec uses the Internet Key Exchange (IKE) protocol to facilitate and automate the SA setup and the exchange of
keys between parties transferring data. IPSec requires that keys be re-created, or refreshed, frequently so that
the parties can communicate securely with each other. IKE manages the process of refreshing keys; however,
a user can control the key strength and the refresh frequency. Refreshing keys on a regular basis ensures data
confidentiality between sender and receiver.
