I have read many comparisons of IPsec Transport vs. Tunnel mode, and there is a clear understanding that when two gateways are exchanging routed traffic they should use Tunnel mode. In other words, Transport mode should be used only between two hosts (or two gateways if they are communicating between each other, not routing traffic). What I try to understand is if Transport mode can be used in a gateway-to-gateway setting, even if not recommended.
My setting is as follows:
LAN1 <-> GW1 <-> GW2 <-> LAN2
In my case I want to protect the link between GW1 and GW2 (containing IP traffic from/to LAN1 to/from LAN2). It is a direct connection, no routing involved, no NAT, nothing. All the reasons for which Tunnel mode is recommended (and Transport mode is not) do not apply to my case - I am OK to leave the IP headers unencrypted and so on. I want to spare overhead bytes, so I would like to use Transport mode even if it is not recommended in this case.
I am using Ubuntu Linux with Strongswan package and IPsec in ESP mode.
My question is: is it at all possible ?
Is there a "fundamental" reason that makes it impossible, or is it just "not recommended / not usually done / not in the Cisco manual" but doable ?
Does anybody have a configuration file that works ?