Skip to content

08-01: Exercises

Question

An original IP packet looks like this (simplified):

[ IP header: src=10.0.0.5, dst=10.0.1.9 ] [ TCP header ] [ Payload data ]

This packet needs to travel securely between two branch-office gateways (GW-A at public IP 203.0.113.1 and GW-B at public IP 198.51.100.1) over the public internet using IPsec.

  1. Draw out (in text) what the packet looks like under tunnel mode.
  2. Draw out what the packet looks like under transport mode.
  3. Which mode is appropriate for this site-to-site scenario, and why?

Solution

Step 1: Tunnel mode layout

In tunnel mode (see 08-03: Tunnel vs. Transport Mode), the entire original IP packet — header and all — is encrypted and encapsulated inside a brand-new outer IP packet:

[ New outer IP header: src=203.0.113.1, dst=198.51.100.1 ]
[ ESP header ]
  [ Original IP header: src=10.0.0.5, dst=10.0.1.9 ]   ← encrypted
  [ Original TCP header ]                               ← encrypted
  [ Original Payload data ]                              ← encrypted
[ ESP trailer/auth ]

Everything from the original IP header down is wrapped and encrypted; only the new outer header (using the gateways' public IPs) is visible in plaintext on the public internet.

Step 2: Transport mode layout

In transport mode, only the payload is protected — the original IP header stays in place and stays visible:

[ Original IP header: src=10.0.0.5, dst=10.0.1.9 ]   ← NOT encrypted, stays visible
[ ESP header ]
  [ Original TCP header ]                              ← encrypted
  [ Original Payload data ]                             ← encrypted
[ ESP trailer/auth ]

Step 3: Which mode fits this scenario

This is a site-to-site scenario: two internal private networks (behind 10.0.0.x and 10.0.1.x) need to communicate over the public internet, but those private addresses are not routable on the public internet at all — a packet with a public-internet source/destination of 10.0.0.5/10.0.1.9 would simply never make it across the internet.

  • Tunnel mode solves this directly — it wraps the whole original packet (private addresses and all) inside a new packet addressed between the two gateways' public IPs, which the internet can route.
  • Transport mode would leave the original private-address header exposed and unroutable on the public internet, and it also wouldn't provide a new set of publicly-routable endpoints at all — transport mode is designed for host-to-host protection where both endpoints already have real, routable addresses talking directly to each other, not for bridging two private networks.

👉 Tunnel mode is the correct choice for site-to-site VPNs — it's specifically why 08-01: VPN Concepts & Types and 08-02: IPsec Fundamentals describe tunnel mode as the site-to-site default.

Final Answer

  • Tunnel mode: entire original packet (header + payload) encrypted, wrapped in a new outer IP header using the gateways' public addresses.
  • Transport mode: original IP header stays visible in plaintext; only the payload (and inner TCP header) is encrypted.
  • Tunnel mode is correct here — it's the only option that makes the private, unroutable internal addresses work across the public internet by hiding them inside a publicly-addressed outer packet.