I understand that transport mode encrypts only the payload.

Do IPSec clients such as Cisco's AnyConnect and/or Cisco VPN Client use transport mode? Or do these clients and others like them use tunnel mode?

  • Does this help: firewall.cx/networking-topics/protocols/870-ipsec-modes.html
    – schroeder
    May 26, 2015 at 3:00
  • Not sure cuz it says RDP uses transport mode however this article seems to say otherwise. May 26, 2015 at 3:05
  • is RDP an important consideration for you, or do you doubt the article because it is not accurate? (trying to get a sense of your requirements)
    – schroeder
    May 26, 2015 at 3:07
  • Just trying to understand a real world use of transport mode, i.e., the name of software that utilizes it. May 26, 2015 at 3:08

2 Answers 2


Client-side VPNs (AnyConnect, RDP) use transport mode because they set up end-to-end or end-to-site encryption. They do not rely on any other security infrastructure to create and maintain the tunnel.

Tunnel mode is most often done between VPN gateways (routers) that maintain the tunnel without needing to install or configure the clients.

Some clients can make use of VPN gateways as well, but when your client is "all alone", they use transport mode.


AnyConnect and Cisco VPN Client use tunnel mode, as the communication is actually between the initiator (VPN client) and devices behind the VPN gateway.

  • this is true only in the case where you are connecting to a device behind a VPN gateway
    – schroeder
    May 26, 2015 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.