ZyXEL Communications 1000 User Manual

 Chapter 25 IPSec VPN

ZyWALL USG 1000 User’s Guide

These modes are illustrated below.

In tunnel mode, the ZyWALL uses the active protocol to encapsulate the entire IP 
packet. As a result, there are two IP headers:

• Outside header: The outside IP header contains the IP address of the ZyWALL or 

remote IPSec router, whichever is the destination.

• Inside header: The inside IP header contains the IP address of the computer 

behind the ZyWALL or remote IPSec router. The header for the active protocol 

(AH or ESP) appears between the IP headers.

In transport mode, the encapsulation depends on the active protocol. With AH, the 
ZyWALL includes part of the original IP header when it encapsulates the packet. 
With ESP, however, the ZyWALL does not include the IP header when it 
encapsulates the packet, so it is not possible to verify the integrity of the source IP 
address.

An IPSec SA proposal is similar to an IKE SA proposal (see 

), except that you also have the choice whether or not the ZyWALL and 

remote IPSec router perform a new DH key exchange every time an IPSec SA is 
established. This is called Perfect Forward Secrecy (PFS).

If you enable PFS, the ZyWALL and remote IPSec router perform a DH key 
exchange every time an IPSec SA is established, changing the root key from which 
encryption keys are generated. As a result, if one encryption key is compromised, 
other encryption keys remain secure.

If you do not enable PFS, the ZyWALL and remote IPSec router use the same root 
key that was generated when the IKE SA was established to generate encryption 
keys.

The DH key exchange is time-consuming and may be unnecessary for data that 
does not require such security.

Figure 341   VPN: Transport and Tunnel Mode Encapsulation

IP Header TCP 

Header

Data

Transport Mode Packet IP Header AH/ESP 

Header

TCP 
Header

Data

IP Header AH/ESP 

Header

IP Header TCP 

Header

Data