Editing IPsec (section)

==Modes of operation==
The IPsec protocols AH and ESP can be implemented in a host-to-host transport mode, as well as in a network tunneling mode.
[[File:Ipsec-modes.svg|thumb|IPsec Modes]]

===Transport mode===
In transport mode, only the payload of the IP packet is usually [[encrypted]] or authenticated. The routing is intact, since the IP header is neither modified nor encrypted; however, when the [[Authentication Header|authentication header]] is used, the IP addresses cannot be modified by [[network address translation]], as this always invalidates the [[hash value]]. The [[transport layer|transport]] and [[application layer|application]] layers are always secured by a hash, so they cannot be modified in any way, for example by [[port address translation|translating]] the [[TCP and UDP port|port]] numbers.

A means to encapsulate IPsec messages for [[NAT traversal]] (NAT-T) has been defined by [[Request for Comments|RFC]] documents describing the NAT-T mechanism.

===Tunnel mode ===
In tunnel mode, the entire IP packet is encrypted and authenticated. It is then encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create [[virtual private network]]s for network-to-network communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access) and host-to-host communications (e.g. private chat).<ref>William, S., & Stallings, W. (2006). Cryptography and Network Security, 4/E. Pearson Education India. p. 492-493</ref>

Tunnel mode supports NAT traversal.