AH Modes
AH can be used in either transport or tunnel mode, just like ESP. The difference is the data being protected, either an upper-layer protocol or an entire IP datagram.
Transport Mode
When used in transport mode, AH protects end-to-end communication. The communications endpoint must be IPSec endpoint. The AH header is inserted into the datagram by placing it immediately following the IP header (and any options) and before the upper-layer protocol header.
Figure 6.2. An IP packet before and after protection with transport mode AH.
Tunnel Mode
When used in tunnel mode, AH encapsulates the protected datagram. An additional IP header is added before the AH header after that. The "internal" IP datagram maintains the original addressing of the communication and the "outer" IP datagram contains the addresses of the IPSec endpoints. Tunnel mode can be used as a replacement to transport mode for end-to-end security. However, as there is no confidentiality and therefore no protection against traffic analysis, it is pointless. AH is used only to guarantee that the received packet was not modified in transit, that it was sent by the party claiming to have sent it, and, optionally, that it is a fresh, nonreplayed packet.
Figure 6.3. An IP packet before and after protection with tunnel mode AH.
Top IPSec (2nd Edition) ISBN: 013046189X
EAN: 2147483647 Year: 2004
Pages: 76 Authors: Naganand Doraswamy, Dan Harkins
flylib.com © 2008-2017. If you may any questions please contact us: flylib@qtcs.net |