Figure 115 Vpn: Transport And Tunnel Mode Encapsulation; Ipsec Protocol - ZyXEL Communications X550N - V3.60 User Manual

Chapter 15 IPSec VPN
If router A does not have an IPSec pass-through or if the IPSec protocol is AH, you can solve
this problem by enabling NAT traversal. In NAT traversal, router X and router Y add an extra
header to the IKE SA and IPSec SA packets. If you configure router A to forward these
packets unchanged, router X and router Y can establish a VPN tunnel.
You have to do the following things to set up NAT traversal.
• Enable NAT traversal on the X550N and remote IPSec router.
• Configure the NAT router to forward packets with the extra header unchanged.
The extra header may be UDP port 500 or UDP port 4500, depending on the standard(s) the
X550N and remote IPSec router support.

IPSec Protocol

The IPSec protocol controls the format of each packet. It also specifies how much of each
packet is protected by the encryption and authentication algorithms. IPSec VPN includes two
IPSec protocols, AH (Authentication Header, RFC 2402) and ESP (Encapsulating Security
Payload, RFC 2406).
Note: The X550N and remote IPSec router must use the same IPSec protocol.
Usually, you should select ESP. AH does not support encryption, and ESP is more suitable
with NAT.
Encapsulation
There are two ways to encapsulate packets. Usually, you should use tunnel mode because it is
more secure. Transport mode is only used when the IPSec SA is used for communication
between the X550N and remote IPSec router (for example, for remote management), not
between computers on the local and remote networks.
Note: The X550N and remote IPSec router must use the same encapsulation.
These modes are illustrated below.

Figure 115 VPN: Transport and Tunnel Mode Encapsulation

Original Packet
Transport Mode Packet
Tunnel Mode Packet
188
IP Header TCP Data
Header
IP Header AH/ESP TCP
Header Header
IP Header AH/ESP IP Header
Header
Data
TCP Data
Header
X550N Series User's Guide