The tunnel mode protects all IP data and encapsulates the new IP header without using the original IP header for routing. Add a new IP header before the IPSec header, the source and destination is the IPSec peer address. And allow the address specified by RFC 1918 (private address) to participate in VPN traversing the Internet.
AH Tunnel
modeAH Tunnel mode ESP Tunnel modeESP Tunnel mode
modeAH Tunnel mode ESP Tunnel modeESP Tunnel mode
Transport mode: The transport mode protects the data behind the original IP header, inserting an IPSec header (ESP or AH) between the original IP header and the payload. A typical application is an end-to-end conversation, and the original IP header is required to be globally routable.
AH Transport mode
AH Transport mode ESP Transport modeESP Transport mode
AH Transport mode ESP Transport modeESP Transport mode
The difference between the two lies in the content of the ESP payload part of the IP datagram.
In tunnel mode, the entire IP datagram is encapsulated and encrypted in the ESP payload. When this is done, the real IP source and destination addresses can be hidden as ordinary data sent by the Internet. A typical usage of this mode is to hide the host or topology when the firewall-firewall is connected through a virtual private network. In the transmission mode, only higher layer protocol frames (TCP, UDP, ICMP, etc.) are placed in the ESP payload part of the encrypted IP datagram. In this mode, the source and destination IP addresses and all IP header fields are sent without encryption.
Simply put, when the encryption point is not equal to the communication point, it is the tunnel mode, and if the encryption point is equal to the communication point, it is the transmission mode. But note that by default it is in tunnel mode and you need to change it. You can see this in show crypto ipsec sa. Because the transmission mode has one header less than tunnel mode, it provides more load space, so Try to use transfer mode.
Transport is used when two computers are directly connected via IPSec VPN. Tunnel is required to use Tunnel mode as long as one end uses a gateway. Because if one end of the Transport connection is a gateway, the gateway has the NAT function, which will change the address, and the transmission only recognizes the original IP, so it will be directly discarded. The Tunnel tunnel mode is to directly establish a tunnel for communication between the two ends, and will not be abandoned.
The data encapsulation in tunnel and transport modes is shown in the figure below, where data is the original IP packet.
Two working modes of IPSec and its packet encapsulation formatTwo working modes of IPSec and its packet encapsulation format
Report
