HP TMS zl Module Security Administrator's Guide

4-11
Configuring a VPN on the HP TMS zl Module
IPsec VPNs
In tunnel mode, an AH header authenticates both the payload (including the
original IP header) and the delivery IP header. An ESP header authenticates
only the payload (including the original IP header) but can also encrypt the
payload.
Transport Mode
In transport mode, a packet is encapsulated with an IPsec header before the
IP header is added, thereby reducing overhead. Because the header must be
applied before the traffic is ever transmitted, however, both ends of the tunnel
must be the ultimate originators of the traffic.
You can use transport mode to secure traffic for sessions that terminate on
the module itself. For example, transport mode is used for the IPsec traffic in
L2TP over IPsec connections as well as GRE over IPsec connections because,
as the gateway to the L2TP or GRE tunnel, the module is the originator of the
L2TP or GRE packet that is encapsulated by IPsec.
Figure 4-5. Transport Mode
In transport mode, an AH header authenticates the entire packet including the
IP header. The ESP header authenticates only the payload but can also encrypt
the payload.
Authentication and Encryption Algorithms
To provide data integrity, an IPsec tunnel endpoint uses authentication algo-
rithms to transforms packets. An authentication algorithm uses a specific key
to generate a unique message digest for a packet, which the remote endpoint
checks using the same key and algorithm. If the data has been altered, the
integrity check fails.