I understand that transport mode encrypts only the payload.

Do IPSec clients such as Cisco's AnyConnect and/or Cisco VPN Client use transport mode? Or do these clients and others like them use tunnel mode?

  • Not sure cuz it says RDP uses transport mode however this article seems to say otherwise. – Ron Royston May 26 '15 at 3:05
  • is RDP an important consideration for you, or do you doubt the article because it is not accurate? (trying to get a sense of your requirements) – schroeder May 26 '15 at 3:07
  • Just trying to understand a real world use of transport mode, i.e., the name of software that utilizes it. – Ron Royston May 26 '15 at 3:08

Client-side VPNs (AnyConnect, RDP) use transport mode because they set up end-to-end or end-to-site encryption. They do not rely on any other security infrastructure to create and maintain the tunnel.

Tunnel mode is most often done between VPN gateways (routers) that maintain the tunnel without needing to install or configure the clients.

Some clients can make use of VPN gateways as well, but when your client is "all alone", they use transport mode.


AnyConnect and Cisco VPN Client use tunnel mode, as the communication is actually between the initiator (VPN client) and devices behind the VPN gateway.

  • this is true only in the case where you are connecting to a device behind a VPN gateway – schroeder May 26 '15 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.