OT: IPSec Transport vs Tunnel modes (Was: VPN recommendations?)

Thu Feb 17 06:44:01 UTC 2022

It's not like IPsec protocols (it's a suite of protocols and concepts, not
one) are proprietary or something. There are pretty ASCII pictures in RFCs
with all about how the packets are put together. See section 3 of RFC 4303
to see how ESP transport and tunnel mode datagrams are put together.

For the tl;dr, in transport mode everything above IP header is the payload.
In tunnel mode, the whole IP datagram is the payload. The contents of the
payload are specified by the "Next Header" field of the ESP header. For an
encapsulated IPv4 packet, it would be protocol 4 (IP-in-IP). For an IPv6
packet, it would be 41. For TCP in transport mode, it would be 6. UDP is
17. Etc.

If you want to see it in action yourself, you can set the encryption algo
to NULL and do a capture.

On Tue, Feb 15, 2022 at 10:16 AM Grant Taylor via NANOG <nanog at nanog.org>
wrote:

> Hi Bill,
>
> On 2/12/22 8:55 PM, William Herrin wrote:
> > It's tunnel mode plus a tunneling protocol plus some implicit routing
> > and firewalling which gets in the way of dynamic routing.
>
> I assume you meant to say that it's /transport/ mode plus a tunneling
> protocol.
>
> I wonder if you are thinking more of an IPSec VPN management suite of
> sorts, e.g. wizard / helper that is included in some devices.  I'm
> thinking at a very low (manual) level.  The "implicit routing" and
> "firewalling" are the strongest indicators of this to me.  The manual
> IPSec that I've done on Linux (via the `ip xfrm` command) doesn't touch
> firewalling and I believe that addresses inside the tunnel would be
> completely separate operations / commands.
>
> > Try it if you don't believe me. Set up tunnel mode ipsec manually on
> > two nodes (no IKE) and get them talking to each other. Then change
> > one to transport mode and add I think it's an IPIP tunnel but I don't
> > remember for certain. And add the appropriate routes into the tunnel
> > virtual device. You'll find they talk.
>
> Unfortunately I don't have the leisure time to do this experimentation
> currently.  As such I'm going to put this on my to-do pile for future
> investigation ~> follow up.
>
> I do not recall reading about IPSec /Tunnel/ mode re-using an existing
> tunneling protocol; IPIP, etc.  Perhaps I'm misremembering.  Perhaps it
> inherently does so without declaring as such.
>
> > What did you think IPSec was doing? Transport mode encrypts the layer
> > 4 and up of the packet between two machines; it doesn't encapsulate
> > it. When they added tunnel mode, the inner layer 3 had to go somewhere.
>
> My understanding is that /Transport/ mode applies AH (no encryption) and
> / or ESP (encryption) to L4 datagrams and that /Tunnel/ mode does the
> same to L3 packets.
>
> P.S.  I'm sending this reply to NANOG in case anyone else has any
> contribution / comments.  I suspect any future reply will be directly to
> Bill as this is getting further off topic, both for NANOG in general and
> for this VPN recommendations thread.
>
>
>
> --
> Grant. . . .
> unix || die
>
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://mailman.nanog.org/pipermail/nanog/attachments/20220216/f882cbbe/attachment.html>