DataTerminology.comNEW
An IPsec mode that protects only the IP packet payload between endpoints, leaving the original header intact.
DESCRIPTION
Transport mode is an IPsec configuration where ESP or AH secures the payload of IP packets. It enables end-to-end protection between hosts while preserving routing with the original IP header. Commonly used for host-to-host scenarios, it contrasts with tunnel mode, which encapsulates the entire packet. Policies and security associations govern cryptographic algorithms and keys negotiated via IKEv2. Proper configuration ensures confidentiality, integrity, and anti-replay.
ALTERNATIVE DEFINITIONS
IETF RFC 4301
Transport mode provides protection primarily for upper-layer protocols; it protects the payload of the IP packet, and the header of the IP packet is not protected.
Clarifies header vs payload protection in IPsec architecture.
IETF RFC 4303
ESP can be used to provide confidentiality, data origin authentication, connectionless integrity, an anti-replay service, and limited traffic flow confidentiality in transport mode.
Details ESP services available in transport mode.
Wikipedia
IPsec supports transport and tunnel modes. In transport mode, only the payload of the IP packet is protected.
Accessible summary of transport vs tunnel modes.
RELATED TERMS
IPsec Protocol Suite Encapsulating Security Payload Authentication Header IKEv2 Virtual Private Network Packet Payload Data Encryption Integrity Security Association
COMPETING TERMS
RELATIONS
- Broader: Mode
KNOWLEDGE AREAS
Data Security Infrastructure Data Privacy & Compliance
TARGET AUDIENCE
Security Architect Cybersecurity Engineer Chief Information Security Officer Cloud Architect IT Manager
EXTERNAL SOURCES
- Wikipedia - IPsec
- Microsoft - Windows IPsec architecture overview
- Cisco - IPsec configuration and modes guide
- IETF - IPsec security architecture
TOP QUESTIONS
When should Transport Mode be used in IPsec?
Use transport mode for host-to-host protection when routing requires original headers. It’s common for end-to-end application security.
Category: Example
How does Transport Mode differ from Tunnel Mode?
Transport mode secures payload only, preserving headers; tunnel mode encapsulates entire packets for network-to-network or host-to-network VPNs.
Category: Misunderstanding
What risks exist with Transport Mode?
Exposed IP headers may leak metadata. Ensure proper policies and anti-replay protections to mitigate attacks.
Category: Risk
Which protocols operate in Transport Mode?
ESP and AH can operate in transport mode, providing confidentiality, integrity, and authentication depending on configuration.
Category: Overview
How is Transport Mode negotiated?
IKEv2 negotiates security associations, algorithms, and keys. Policies define endpoints and traffic selectors.
Category: Management
What is anti-replay in Transport Mode?
A mechanism that prevents attackers from resending captured packets. ESP sequence numbers and windows enforce this.
Category: Requirements
Can Transport Mode be used for VPNs?
It’s less common for site-to-site VPNs compared to tunnel mode, but can secure specific application flows between hosts.
Category: Opinion
Where to learn Transport Mode configuration?
Follow vendor guides (Microsoft, Cisco) and read the IETF RFCs for formal specifications and best practices.
Category: Requirements
What metrics indicate healthy Transport Mode?
Low packet loss, valid SA lifetimes, consistent throughput, and minimal replays or integrity failures.
Category: Requirements