🔀VPN Modes

NEW

Operational modes of VPN protection, primarily tunnel mode and transport mode in IPsec contexts.

DESCRIPTION

VPN modes define how packets are protected and encapsulated. In IPsec transport mode, only the payload is protected, suitable for host-to-host communications. In tunnel mode, the entire IP packet is encapsulated within a new IP header, typical for gateway-to-gateway (site-to-site) VPNs. Mode choice influences routing, addressing, and visibility for network devices. Selecting the right mode is crucial for correct topology and security outcomes.

ALTERNATIVE DEFINITIONS

NIST

IPsec can protect IP traffic in two ways: transport mode and tunnel mode.

Concise delineation of the two protection modes.

Source

Cisco

Tunnel mode encapsulates the entire IP packet, while transport mode protects only the payload of the IP packet.

Clarifies encapsulation differences between the two modes.

Source

RELATED TERMS

IPsec Protocol Suite ESP AH Virtual Private Network Site-to-Site VPN Host-to-Host VPN

COMPETING TERMS

Transport Mode Tunnel Mode

KNOWLEDGE AREAS

Data Security Infrastructure

TARGET AUDIENCE

Security Architect Cybersecurity Engineer Cloud Architect

EXTERNAL SOURCES

• Wikipedia - IPsec#Modes of operation
• IETF - Defines tunnel and transport modes
• NIST - Explanation of IPsec modes

TOP QUESTIONS

What is tunnel mode in VPNs?

It encapsulates the entire original IP packet within a new one. This is typical for site-to-site VPNs.

Category: Example

What is transport mode in VPNs?

It protects only the IP payload, leaving the original headers visible. Used in host-to-host scenarios.

Category: Example

How do VPN modes affect routing?

Tunnel mode introduces new outer headers enabling network-to-network routing. Transport mode preserves original addressing.

Category: Requirements

Which mode is more common for enterprises?

Tunnel mode is prevalent for site-to-site connectivity. Transport mode is common for specific host-based protections.

Category: Opinion

Do VPN modes affect performance?

Yes, encapsulation overhead and MTU can differ. Adjust MSS and MTU to prevent fragmentation.

Category: Risks

Can you mix modes in one environment?

Yes, different tunnels can use different modes as required by topology and policy.

Category: Management

Do SSL/TLS VPNs use the same mode terminology?

Not typically; tunnel/transport mode terminology is mainly associated with IPsec.

Category: Misunderstanding

How do VPN modes interact with NAT?

Tunnel mode often pairs with NAT-T for traversal. Transport mode can be sensitive to address translation.

Category: Example

What’s the biggest mistake with VPN modes?

Choosing transport mode for site-to-site when routing requires tunnel mode, causing traffic blackholes.

Category: Mistakes