23
4.11
ESM
Encapsulating Security Payload (ESP) is a member of the IPSec protocol suite. In IPSec, it
provides origin authenticity, integrity, and confidentiality protection of packets. ESP also
supports encryption-only and authentication-only configurations, but using encryption
without authentication is strongly discouraged because it is insecure. Unlike
Authentication Header (AH), ESP does not protect the IP packet header. However, in
Tunnel Mode, where the entire original IP packet is encapsulated with a new packet
header added, ESP protection is afforded to the whole inner IP packet (including the
inner header) while the outer header remains unprotected. ESP operates directly on
top of IP, using IP protocol number 50.
