Encapsulation - ZyXEL Communications P-792H User Manual

Chapter 12 VPN
Finally, NAT is compatible with ESP in tunnel mode because integrity checks are
performed over the combination of the "original header plus original payload,"
which is unchanged by a NAT device. The compatibility of AH and ESP with NAT in
tunnel and transport modes is summarized in the following table.
Table 50 VPN and NAT
SECURITY PROTOCOL MODE
AH
AH
ESP
ESP
Y* - This is supported in the P-792H v2 if you enable NAT traversal.

12.9.4 Encapsulation

The two modes of operation for IPSec VPNs are Transport mode and Tunnel
mode.
Figure 80 Transport and Tunnel Mode IPSec Encapsulation
Transport Mode
Transport mode is used to protect upper layer protocols and only affects the data
in the IP packet. In Transport mode, the IP packet contains the security protocol
(AH or ESP) located after the original IP header and options, but before any upper
layer protocols contained in the packet (such as TCP and UDP).
With ESP, protection is applied only to the upper layer protocols contained in the
packet. The IP header information and options are not used in the authentication
process. Therefore, the originating IP address cannot be verified for integrity
against the data.
With the use of AH as the security protocol, protection is extended forward into
the IP header to verify the integrity of the entire packet by use of portions of the
original IP header in the hashing process.
176
NAT
Transport N
Tunnel N
Transport Y*
Tunnel Y
P-792H v2 User's Guide