Chapter 16 VPN
LTE-5121 User’s Guide
157
Figure 107
Transport and Tunnel Mode IPSec Encapsulation
Transport Mode
Transport mode is used to protect upper layer protocols and only affects the data in the IP packet.
In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the
original IP header and options, but before any upper layer protocols contained in the packet (such
as TCP and UDP).
With ESP, protection is applied only to the upper layer protocols contained in the packet. The IP
header information and options are not used in the authentication process. Therefore, the
originating IP address cannot be verified for integrity against the data.
With the use of AH as the security protocol, protection is extended forward into the IP header to
verify the integrity of the entire packet by use of portions of the original IP header in the hashing
process.
Tunnel Mode
Tunnel mode encapsulates the entire IP packet to transmit it securely. A Tunnel mode is required
for gateway services to provide access to internal systems. Tunnel mode is fundamentally an IP
tunnel with authentication and encryption. This is the most common mode of operation. Tunnel
mode is required for gateway to gateway and host to gateway communications. Tunnel mode
communications have two sets of IP headers:
• Outside header: The outside IP header contains the destination IP address of the VPN gateway.
• Inside header: The inside IP header contains the destination IP address of the final system
behind the VPN gateway. The security protocol appears after the outer IP header and before the
inside IP header.
16.5.3 IKE Phases
There are two phases to every IKE (Internet Key Exchange) negotiation – phase 1 (Authentication)
and phase 2 (Key Exchange). A phase 1 exchange establishes an IKE SA and the second one uses
that SA to negotiate SAs for IPSec.
Summary of Contents for LTE5121
Page 4: ...Contents Overview LTE 5121 User s Guide 4...
Page 12: ...Table of Contents LTE 5121 User s Guide 12...
Page 13: ...13 PART I User s Guide...
Page 14: ...14...
Page 22: ...Chapter 1 Introduction LTE 5121 User s Guide 22...
Page 28: ...28...
Page 42: ...Chapter 4 Broadband LTE 5121 User s Guide 42...
Page 70: ...Chapter 5 Wireless LTE 5121 User s Guide 70...
Page 98: ...Chapter 7 Static Route LTE 5121 User s Guide 98...
Page 102: ...Chapter 8 DNS Route LTE 5121 User s Guide 102...
Page 114: ...Chapter 9 Quality of Service QoS LTE 5121 User s Guide 114...
Page 138: ...Chapter 14 Parental Control LTE 5121 User s Guide 138...
Page 148: ...Chapter 15 Certificates LTE 5121 User s Guide 148...
Page 151: ...Chapter 16 VPN LTE 5121 User s Guide 151 Figure 104 IPSec VPN Add...
Page 162: ...Chapter 16 VPN LTE 5121 User s Guide 162...
Page 198: ...Chapter 19 User Account LTE 5121 User s Guide 198...
Page 214: ...Chapter 26 Backup Restore LTE 5121 User s Guide 214...
Page 224: ...Chapter 28 Troubleshooting LTE 5121 User s Guide 224...
Page 234: ...Index LTE 5121 User s Guide 234...