: IPSec Transport Mode
Focus
Focus

IPSec Transport Mode

Table of Contents

IPSec Transport Mode

Configure IPSec transport mode for encrypting host-to-host communications.
While PAN-OS
®
supports tunnel mode by default, you can now configure IPSec tunnels to use transport mode when encrypting host-to-host communications. Transport mode encrypts only the payload while retaining the original IP header. You can use transport mode to encrypt the management traffic with the most secure protocols.
Transport mode supports:
  • IPv4 address only.
  • Encapsulating Security Payload (ESP) protocol only.
  • IKEv2 only.
  • DH-group 20 for Diffie-Hellman (DH) group and perfect forward secrecy (PFS).
  • Only AES with 256-bit keys in GCM mode.
Certain protocols do not provide payload encryption when exchanging information with other peer. Some protocols use MD5 authentication between peers, which is no lon4ger adequate for communication exposed to a public internetwork. By using IPSec, we can protect the content of management plane protocols. The default setting of IPSec is tunnel mode, which uses both encryption and authentication to protect a complete site. In some cases, this is not sufficient to protect management protocol peers since the cipher used may be independent of the site. Even within a single domain, management plane data may have to be confidential. In such cases, IPSec in transport mode enables you to encrypt the management traffic with the most secure protocols.
In transport mode, data within the original IP packet is protected, but not the IP header. Transport mode sends encrypted traffic directly between two hosts that have previously established a secure IPSec tunnel. Transport mode should only be enabled when the device that generates and protects the packet is also the one that verifies and decrypts the packet.
A transport mode process does not create a new IP header, therefore it is less complex.
While configuring an IPSec tunnel, you can now select the
IPSec Mode
as
Tunnel
or
Transport
mode to establish a secure connection. That is, you can select whether to encrypt or authenticate packets in transport mode or tunnel mode.
Differences between Tunnel and Transport Mode
Tunnel Mode
Transport Mode
Encrypts the entire packet, including the IP header. A new IP header is added to the packet after encryption.
Encrypts only the payload, while the original IP header is retained.
Tunnel monitoring uses the tunnel interface IP address.
Tunnel monitoring automatically uses the IP address of the physical interface (gateway interface IP address), and tunnel interface IP address is ignored.
Supports double encapsulation.
No support for double encapsulation.
This mode is commonly used for site-to-site communications.
This mode is commonly used for host-to-host communications.
Important points to remember before enabling the transport mode:
  • You can't select transport mode when NAT-T is enabled.
  • You can't configure an IKE gateway on a loopback interface to an IPSec tunnel with transport mode.
  • IPSec transport mode does not use proxy ID settings for negotiation. Hence, you cannot configure a proxy ID in transport mode. If you attempt to configure proxy ID by any other method, it will be replaced with 0.0.0.0/0 automatically.
  • You can use transport mode only with an
    auto-key
    key exchange.
  • If you configure a IKE gateway without an IPSec tunnel, by default IKE negotiates a tunnel mode child security association (SA).
  • In IPSec transport mode without GRE encapsulation, don't route the user traffic through the associated tunnel interface. Configure the control protocols (like, BGP peering sessions) on a physical interface (for example, ethernet1/1) instead of a tunnel interface. While IPSec tunnel mode for BGP routes works with the tunnel interface, IPSec transport mode for BGP routes works with the physical interface only.
  • By default, IPSec tunnel operates in
    Tunnel
    mode.
  • You should enable
    Add GRE Encapsulation
    in
    Transport
    mode to encapsulate multicast packets.
To enable IPSec transport mode, select
Network
IPSec Tunnel
and then select
Show Advanced Options
. From
Show Advanced Options
, select the
IPSec Mode
as
Transport
mode to encrypt or authenticate packets in transport mode.

Recommended For You