ZyXEL Communications P-334U - Manual (Page 145)

P-334U/P-335U User’s Guide
Chapter 13 IPSec VPN 145
Usually, you should select ESP. AH does not support encryption, and ESP is more suitable
with NAT.
13.1.3.3 Encapsulation
There are two ways to encapsulate packets. Usually, you should use tunnel mode because it is
more secure. Transport mode is only used when the IPSec SA is used for communication
between the ZyXEL Device and remote IPSec router (for example, for remote management),
not between computers on the local and remote networks.
Note: The ZyXEL Device and remote IPSec router must use the same encapsulation.
These modes are illustrated below.
Figure 88 VPN: Transport and Tunnel Mode Encapsulation
Original Packet IP Header TCP
Header
Data
Transport Mode Packet IP Header AH/ESP
Header
TCP
Header
Data
Tunnel Mode Packet IP Header AH/ESP
Header
IP Header TCP
Header
Data
In tunnel mode, the ZyXEL Device uses the IPSec protocol to encapsulate the entire IP packet.
As a result, there are two IP headers:
• Outside header: The outside IP header contains the IP address of the ZyXEL Device or
remote IPSec router, whichever is the destination.
• Inside header: The inside IP header contains the IP address of the computer behind the
ZyXEL Device or remote IPSec router. The header for the IPSec protocol (AH or ESP)
appears between the IP headers.
In transport mode, the encapsulation depends on the IPSec protocol. With AH, the ZyXEL
Device includes part of the original IP header when it encapsulates the packet. With ESP,
however, the ZyXEL Device does not include the IP header when it encapsulates the packet,
so it is not possible to verify the integrity of the source IP address.
13.1.3.4 IPSec SA Proposal and Perfect Forward Secrecy
An IPSec SA proposal is similar to an IKE SA proposal (see IKE SA Proposal on page 141 ),
except that you also have the choice whether or not the ZyXEL Device and remote IPSec
router perform a new DH key exchange every time an IPSec SA is established. This is called
Perfect Forward Secrecy (PFS).
If you enable PFS, the ZyXEL Device and remote IPSec router perform a DH key exchange
every time an IPSec SA is established, changing the root key from which encryption keys are
generated. As a result, if one encryption key is compromised, other encryption keys remain
secure.