Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am learning about IPsec's transport and tunnel modes. I understand that transport mode encrypts only the payload of an IP packet and is used for communication between two entities that both implement IPsec. I understand that tunnel mode encrypts the entire packet and is often used between two gateways (like firewalls at the edges of a network). I have two questions that I think are related:

  1. Why does the header information have to be encrypted in tunnel mode?
  2. If the header information is encrypted, how are packets routed? Don't headers contain information like: hey, send this packet to 2001:db8:85a3:8d3:1319:8a2e:370:7348. If the header is encrpyted, how is the packet routed?
share|improve this question
add comment

2 Answers

up vote 5 down vote accepted

It is not that the header has to be encrypted in tunnel mode; rather, if the header is not encrypted, it is not really a tunnel.

Tunnel mode is about having two routers linked together with an encrypted tunnel. They exchange packets for other hosts. Schematically, router A is the exit router for network netA, and router B is the exit router for network netB. A and B run an IPSec tunnel. Whenever a machine in network netA wants to send a packet to a machine in network netB, then that machine sends the packet to its exit router, i.e. router A. Router A sends the packet to router B within the tunnel. Router B receives the encrypted packet, but decrypts it upon reception, and discovers for which machine in netB the packet should be sent. Router B proceeds to send the packet to the final destination machine.

With the tunnel:

  • The source and destination machines which talk to each other don't need to be aware of IPSec; only the two routers at both ends of the tunnel.
  • Eavesdroppers on the link between routers A and B (i.e. the "bad people on the Internet") only see encrypted data and cannot even know which machine is talking to each machine, since the whole packet is encrypted, including header.
share|improve this answer
    
so an entirely encrypted packet is not really 'routed' (i.e. forwarded along routers in a network). A and B send totally encrypted packets directly to each other. The packets don't travel thru the internet like other packets (although packets might be routed within network A or B). –  akh2103 Apr 23 '13 at 23:27
    
The packets will still be routed through the Internet unless both of the routers are on the same local network. –  Hammo Apr 24 '13 at 1:17
    
@hammo so then the headers are of course not encrypted? –  akh2103 Apr 24 '13 at 21:42
    
@tomleek in tunnel mode is the entire original packet encrypted and then wrapped inside another packet with un-encrypted headers? Then the target gateway unencrypts the original packet? –  akh2103 Apr 24 '13 at 21:54
    
@akh2103: yes, that's about that. –  Tom Leek Apr 24 '13 at 22:31
add comment

When used in tunnel mode IPsec treats the IP packet as a payload. Therefore, all this information is encrypted. In order to be routed correctly, the IPSec-enabled entity then build a new packet.

This IP packet is built to be send to the tunnel end, e.g. another IPSec gateway. So as to achieve this, the new IP packet will have a brand new IP-Header, with destination IP set to this particular equipment address. The rest of the packet will contain the traditional ESP data composed of a header, payload (the original packet) trailer and authentication data.

Here is a schematic of the packet and it's encapsulation into a tunnel-mode IPSec packet:

                         +--------------------+----------------------------+
                         | Original IP-Header | Encapsulated protocol data |
                         +--------------------+----------------------------+
                         |                                                 |
                         |                                                 |
+-----------+------------+--------------------+----------------------------+-------------+---------------------+
| IP-Header | ESP Header | Original IP-Header | Encapsulated protocol data | ESP Trailer | Authentication data |
+-----------+------------+--------------------+----------------------------+-------------+---------------------+
                         |<--------------------------Encrypted-------------------------->|
            |<---------------------------------------Authenticated---------------------->|

The main interest of the tunnel mode is to protect the (internal) addresses of a network. You can take as an example a company with two offices separated by X kilometres. Two IPSec gateway are setup and all traffic from one network to the other is encapsulated in the IPSec tunnel. The only thing visible by an outsider is that the two gateway communicate with each other using IPSec protocol. What's insides could be any type of communication.

The IPSec packet will still follow the rules of internet routing.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.