🛡️Tunnel Mode

NEW

IPsec mode that encapsulates entire IP packets for secure network-to-network or gateway-to-gateway tunnels.

DESCRIPTION

Tunnel mode wraps the original IP packet in a new IP header, protecting the inner packet with IPsec. It’s used for site-to-site VPNs between gateways, enabling secure communication across untrusted networks. ESP and AH provide confidentiality, integrity, and authenticity. The outer header handles routing; the inner header remains hidden. Tunnel mode contrasts with transport mode, which protects only the payload.

ALTERNATIVE DEFINITIONS

RFC 4301

In tunnel mode, IPsec protects an inner IP packet by encapsulating it within an outer IP packet.

Formal definition of tunnel encapsulation in IPsec architecture.

Source

Wikipedia

In tunnel mode, the entire IP packet is encrypted and authenticated.

Highlights end-to-end protection of the full packet.

Source

Cisco

Tunnel mode is typically used to protect traffic between gateways, such as site-to-site VPNs.

Emphasizes practical gateway-to-gateway use cases.

Source

RELATED TERMS

IPsec Protocol Suite Encapsulating Security Payload Authentication Header Virtual Private Network Site-to-Site VPN Security Association Key Exchange IKEv2 Packet Encapsulation

COMPETING TERMS

Transport Mode

RELATIONS

• Broader: Mode

KNOWLEDGE AREAS

Data Security Infrastructure

TARGET AUDIENCE

Security Architect Cloud Architect Cybersecurity Engineer Chief Information Security Officer

EXTERNAL SOURCES

• Wikipedia - IPsec
• IETF - IPsec security architecture specification
• Cisco - Technical note on IPsec modes
• Microsoft Azure - Site-to-site VPN settings overview

TOP QUESTIONS

What is Tunnel Mode in IPsec?

It encapsulates entire IP packets inside a new outer IP header, securing network-to-network communication.

Category: Definition

How does Tunnel Mode differ from Transport Mode?

Tunnel mode protects the whole packet; transport mode protects only the payload and certain header fields.

Category: Comparison

When should I use Tunnel Mode?

Use it for site-to-site or gateway-to-gateway VPNs across untrusted networks.

Category: UseCase

What protocols are used with Tunnel Mode?

ESP provides confidentiality; AH provides integrity and authentication; IKE manages keys.

Category: Mechanism

What are the security benefits of Tunnel Mode?

It hides internal addressing, provides end-to-end packet protection, and reduces exposure to traffic analysis.

Category: Benefits

What are performance considerations in Tunnel Mode?

Encapsulation adds overhead; choose hardware acceleration and appropriate MTU to avoid fragmentation.

Category: BestPractices

How do routing and addresses work in Tunnel Mode?

Outer headers route traffic; inner headers preserve original source and destination inside the tunnel.

Category: Mechanism

What is a hot topic around Tunnel Mode?

Integration with SD-WAN and cloud gateways for hybrid connectivity is evolving rapidly.

Category: Topic

How do I troubleshoot Tunnel Mode issues?

Check IKE settings, SAs, MTU, NAT traversal, and logs on both gateways.

Category: HowTo