08-02: Exercises¶
Question¶
Two branch offices need to connect over the public internet. The security requirement states: "traffic between the offices must be both confidential (unreadable to eavesdroppers) and verified as unmodified/authentic."
- Should this use AH or ESP?
- Should this use tunnel mode or transport mode?
- Justify both choices together as a single IPsec configuration decision.
Solution¶
Step 1: AH vs. ESP¶
Per 08-02: IPsec Fundamentals:
| Protocol | Confidentiality (encryption) | Integrity/Authentication |
|---|---|---|
| AH (Authentication Header) | ❌ No | ✔️ Yes |
| ESP (Encapsulating Security Payload) | ✔️ Yes | ✔️ Yes (when configured, which is standard practice) |
The requirement explicitly asks for both confidentiality and integrity/authenticity. AH alone cannot provide confidentiality at all — it only proves the data wasn't tampered with and came from the claimed sender, but an eavesdropper could still read every byte of the traffic.
👉 (1) ESP is required, since it's the only one of the two that can provide encryption. (ESP also provides integrity checking, so nothing is lost by not using AH alongside it.)
Step 2: Tunnel vs. transport mode¶
The scenario is a site-to-site connection between two branch offices' internal networks — this is the same situation covered in 08-01: Tunnel Mode vs. Transport Mode Packet Layout and 08-03: Tunnel vs. Transport Mode: the internal private-network addresses on each side aren't publicly routable, so they need to be wrapped inside a new, publicly-addressed outer packet between the two gateways.
👉 (2) Tunnel mode is required for this site-to-site scenario, for the same reason worked through in 08-01: Tunnel Mode vs. Transport Mode Packet Layout.
Step 3: The combined justification¶
The correct configuration is ESP in tunnel mode:
- ESP satisfies both stated requirements at once (confidentiality via encryption, integrity/authenticity via its built-in authentication) — using AH would leave the confidentiality requirement completely unmet, and there's no benefit to running AH in addition to ESP here since ESP's own authentication already covers integrity.
- Tunnel mode is what makes a site-to-site VPN actually work at the addressing level, regardless of which of AH/ESP is chosen — it's an orthogonal decision to the AH-vs-ESP question, driven purely by the private-to-public addressing problem.
This combination — ESP + tunnel mode — is, in fact, the standard, overwhelmingly common configuration for real-world site-to-site IPsec VPNs, precisely because "confidentiality + integrity, private networks bridged over the public internet" is by far the most common requirement in practice.
Final Answer¶
- ESP (not AH) — it's the only option providing confidentiality, and it also covers integrity/authenticity.
- Tunnel mode (not transport mode) — required to bridge non-routable private addresses across the public internet between gateways.
- Combined: ESP in tunnel mode — the standard configuration for site-to-site VPNs needing both encryption and authentication.