I basically understand how tunnel mode and transport mode works, but I don't know when I should use one instead of another.

Among the two parties who want to communicate, if one computer B doesn't understand IPsec, I think they have to use tunnel mode, which puts original IP and payload into ESP and delivers the packet to a device near B who knows IPsec, and that device decrypts the packet and sends the decrypted packet to computer B.

But what if the two computer both know IPsec, can I use transport mode? Various articles mention that if two computer are in a intranet, use transport; if they are in different networks, use tunnel. Why? If two computers are in different networks and transport mode is used, what problem will happen?

(Try not to mention AH and so-called security gateway, I don't know what they are.)


From Cisco: http://www.ciscopress.com/articles/article.asp?p=25477

Tunnel mode is most commonly used between gateways, or at an end-station to a gateway, the gateway acting as a proxy for the hosts behind it.

Transport mode is used between end-stations or between an end-station and a gateway, if the gateway is being treated as a host—for example, an encrypted Telnet session from a workstation to a router, in which the router is the actual destination.

So what ARE the differences:

Tunnel mode protects any internal routing info by encrypting the IP header of the ENTIRE packet. The original packet is encapsulated by a another set of IP headers.

  • NAT traversal is supported with the tunnel mode.
  • Additional headers are added to the packet; so there is less payload MSS

Transport mode encrypts the payload and ESP trailer ONLY. IP header of the original packet is not encrypted.

  • Transport mode is implemented for client-to-site VPN scenarios.
  • NAT traversal IS NOT supported with the transport mode.
  • MSS is higher

Transport mode is usually with other tunneling protocols (GRE, L2TP) which is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets.


Here is a detailed read on the differences from Microsoft: http://technet.microsoft.com/en-us/library/cc757712%28v=ws.10%29.aspx

  • So if two computers are in different networks and transport mode is used, is there any problem? – Gqqnbig Dec 18 '14 at 3:23
  • You're not understanding the answer... Transport = computer (workstation/laptop/device) to gateway ... Tunnel = gateway to gateway. So you are trying to connect one machine to another what... Gateway, or individual machine? If it's an individual machine, how do get a static address to support the connection. – munkeyoto Dec 18 '14 at 3:32
  • One other consideration: some routing protocols do not work over tunnel mode (those that use multicast or broadcast to establish adjacency or to swap routes). In those cases, you want to use GRE or mGRE to establish your tunnel and protect with transport mode IPSec. See Cisco's reference implementation of DMVPN (mGRE, IPSec in Transport Mode, NHRP, OSPF) for a concrete example and explanation. – DTK Dec 18 '14 at 4:47
  • 2
    Downvoted - contrary to your belief, NAT Traversal IS supported with transport mode, read the specification and how it is done (UDP-Encapsulated-Transport replaces the normal transport mode in NAT-T). – Milen Dec 18 '14 at 13:25
  • 1
    @CiprianTomoiaga en.wikipedia.org/wiki/Maximum_segment_size – Laszlo Valko Dec 6 '16 at 19:37

To elaborate more on Milen's answer, if you have no routing issues, then Transport mode is certainly feasible whether it's 2 gateways talking to each-other, or even 2 hosts talking to each-other (not doing IPsec).

For example, if you had 2 public DMZ servers talking via Telnet over the Internet to each-other, and deeper in the network 2 IPsec routers were used to encrypt that specific traffic. Transport mode would be just fine in this case, since all parties have public IP's on their interfaces:

DMZhost-A >> IPSECrouter-A >> INTERNET >> IPSECrouter-B >> DMZhost-B

This allows the ISP to classify packets based on the IP packet's "Next Header" data, which would show as TCP. However, the TCP port would be hidden within the encrypted portion of the packet (the actual TCP header).

In that sense, the packet is vulnerable to attacker analysis, since he would at least know it's some kind of TCP session, and also would have the real IP's of the DMZ servers.

  • I didnt downvote Milen's answer but I like yours better because its not a copy-paste – Purefan Jan 29 '16 at 15:12

In IPSec transport mode, only the IP payload is encrypted, and the original IP headers are left intact. It also allows devices on the public network to see the final source and destination of the packet. With this capability, you can enable special processing in the intermediate network based on the information in the IP header. However, the Layer 4 header will be encrypted, limiting the examination of the packet. Unfortunately, by passing the IP header in the clear, transport mode allows an attacker to perform some traffic analysis.

enter image description here

Source: Cisco

Having quoted that, this is almost never the case - the underlying payload is most often a tunnelling protocol (e.g. L2TP in case of Windows or mobile clients, could be GRE), so in modern networking terms there are "mitigating" factors against traffic analysis in transport mode.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.