Figure 274 Vpn: Transport And Tunnel Mode Encapsulation; Ipsec Sa Proposal And Perfect Forward Secrecy - ZyXEL Communications ZyWALL USG 100 Series User Manual

Chapter 21 IPSec VPN
The ZyWALL and remote IPSec router must use the same encapsulation.
These modes are illustrated below.

Figure 274 VPN: Transport and Tunnel Mode Encapsulation

Original Packet
Transport Mode Packet
Tunnel Mode Packet
In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP packet. As a
result, there are two IP headers:
• Outside header: The outside IP header contains the IP address of the ZyWALL or remote
IPSec router, whichever is the destination.
• Inside header: The inside IP header contains the IP address of the computer behind the
ZyWALL or remote IPSec router. The header for the active protocol (AH or ESP) appears
between the IP headers.
In transport mode, the encapsulation depends on the active protocol. With AH, the ZyWALL
includes part of the original IP header when it encapsulates the packet. With ESP, however, the
ZyWALL does not include the IP header when it encapsulates the packet, so it is not possible
to verify the integrity of the source IP address.

IPSec SA Proposal and Perfect Forward Secrecy

An IPSec SA proposal is similar to an IKE SA proposal (see
except that you also have the choice whether or not the ZyWALL and remote IPSec router
perform a new DH key exchange every time an IPSec SA is established. This is called Perfect
Forward Secrecy (PFS).
If you enable PFS, the ZyWALL and remote IPSec router perform a DH key exchange every
time an IPSec SA is established, changing the root key from which encryption keys are
generated. As a result, if one encryption key is compromised, other encryption keys remain
secure.
If you do not enable PFS, the ZyWALL and remote IPSec router use the same root key that
was generated when the IKE SA was established to generate encryption keys.
The DH key exchange is time-consuming and may be unnecessary for data that does not
require such security.
390
IP Header TCP Data
Header
IP Header AH/ESP TCP
Header Header
IP Header AH/ESP IP Header
Header
ZyWALL USG 100/200 Series User's Guide
Data
TCP Data
Header
IKE SA Proposal on page 383),