When IPSec VPN is deployed on security devices and encapsulation security payload (ESP) is used as the security protocol, how does a device sent out data packets after the IPSec SA negotiation is successful?
1. Transport Mode
Step 1: The protocol field in the original IP header is copied to the NextHeader field in the ESP trailer.
The protocol field in the original IP header is set to 50, indicating that the upper-layer protocol is ESP.
Values are written into Seq and IV fields.
Because block cipher is used here, pad characters are used to fill up remaining available character spaces in the content to be encrypted, and the Padding Length field is set accordingly.
Step 2: The content following the ESP header is encrypted.
Step 3: Hash calculation is performed on the content following the original IP header, and the hash result is written into the ESP authentication field.
Step 4: CRC in the IP header is recalculated.
2. Tunnel Mode
The ESP header is added before the original IP packet. If the original packet is an IPv4 packet, the Next Header field in the ESP header is set to 4 (indicating the IP header), and the corresponding field is set. Then a new IP header is added before the ESP header. The protocol number in the IP header is set to 50 (indicating ESP).
