FortiGate IPsec VPN

In the section where we introduced the SSL VPN, we said that looking at the TCP/IP protocol stack, usually the delivery protocol is located on a higher level than the payload protocol. This statement is not valid for the next type of VPN, which will be discussed. An IPsec VPN secures each IP (Internet Protocol) packet with authentication and encryption. IPsec uses two different protocols: AH and ESP, to provide authentication, integrity, and confidentiality of the communication. Basic operations related to IPsec include:

• Transport mode: Only the payload of the IP datagram is handled by IPsec, which inserts the header between the IP header and the upper levels.

• Tunnel mode: This is used to protect the entire IP datagram. This is the base of an IPsec VPN that creates a "Layer 3 tunnel". The original packet is encapsulated in a new IP packet (the header of the new packet is IPsec).

In the following diagram we have a schema that shows an original packet compared with the packets...