ZyXEL P-792H v2 User Guide - Page 176
Encapsulation
View all ZyXEL P-792H v2 manuals
Add to My Manuals
Save this manual to your list of manuals |
Page 176 highlights
Chapter 12 VPN Finally, NAT is compatible with ESP in tunnel mode because integrity checks are performed over the combination of the "original header plus original payload," which is unchanged by a NAT device. The compatibility of AH and ESP with NAT in tunnel and transport modes is summarized in the following table. Table 50 VPN and NAT SECURITY PROTOCOL MODE AH Transport AH Tunnel ESP Transport ESP Tunnel NAT N N Y* Y Y* - This is supported in the P-792H v2 if you enable NAT traversal. 12.9.4 Encapsulation The two modes of operation for IPSec VPNs are Transport mode and Tunnel mode. Figure 80 Transport and Tunnel Mode IPSec Encapsulation Transport Mode Transport mode is used to protect upper layer protocols and only affects the data in the IP packet. In Transport mode, the IP packet contains the security protocol (AH or ESP) located after the original IP header and options, but before any upper layer protocols contained in the packet (such as TCP and UDP). With ESP, protection is applied only to the upper layer protocols contained in the packet. The IP header information and options are not used in the authentication process. Therefore, the originating IP address cannot be verified for integrity against the data. With the use of AH as the security protocol, protection is extended forward into the IP header to verify the integrity of the entire packet by use of portions of the original IP header in the hashing process. 176 P-792H v2 User's Guide