In IPSec, which transmission mode is most appropriate for securing communications between two networks across a distance?

In IPSec, which transmission mode is most appropriate for securing communications between two networks across a distance?

• A. Transport mode
• B. Tunnel mode
• C. Gateway mode
• D. Hybrid mode

Answer: (B)

The main idea is to secure communications between two separate networks over a distance. To do that, you need to create a secure tunnel between the edge devices (gateways) at each network. IPSec tunnel mode does exactly this: it encapsulates the entire original IP packet inside a new IP header and encrypts the whole packet, so the networks can send data through a protected path across an untrusted network like the Internet. This site-to-site (network-to-network) setup relies on the gateways performing the encapsulation and routing, making tunnel mode the right choice for long-distance network-to-network security. In contrast, transport mode only encrypts the payload between two hosts and leaves the original IP header unprotected, which is appropriate for end-to-end host-to-host communication within or across a single path, not for linking two separate networks over distance. The other terms aren’t standard IPSec modes, and they don’t provide the required encapsulation for network-to-network VPNs. So tunnel mode best fits securing communications between two networks across distance.

The main idea is to secure communications between two separate networks over a distance. To do that, you need to create a secure tunnel between the edge devices (gateways) at each network. IPSec tunnel mode does exactly this: it encapsulates the entire original IP packet inside a new IP header and encrypts the whole packet, so the networks can send data through a protected path across an untrusted network like the Internet. This site-to-site (network-to-network) setup relies on the gateways performing the encapsulation and routing, making tunnel mode the right choice for long-distance network-to-network security.

In contrast, transport mode only encrypts the payload between two hosts and leaves the original IP header unprotected, which is appropriate for end-to-end host-to-host communication within or across a single path, not for linking two separate networks over distance. The other terms aren’t standard IPSec modes, and they don’t provide the required encapsulation for network-to-network VPNs. So tunnel mode best fits securing communications between two networks across distance.