Question IPsec

minumathur · ‎06-15-2009

Hi

I have created IPsec tunnel between local location to remote location across internet. On internet , there are number of router come in between source to destination .so now my question is how intermediate router will know about about end point destination if the packet is encrypted.

-M

Joseph W. Doherty · ‎06-15-2009

The packet's outer IP addresses (normally tunnel end points) are not encrypted.

bmcginn · ‎06-15-2009

Hi there Pinal,

As Joseph said, the end point addresses aren't encrypted.

The IP header holds information about the endpoints and even tells routers what protocol it is holding (for example the IP packet may be encapsulating a TCP or UDP segment, or the ESP protocol etc). It can hold a boatload of protocols, 255 would be the maximum number as the protocol type field in the IP header is 8 bits long.

When the packet reaches the destination, the tunnel endpoints decapsulate the packet (remove the IP deaer) to find the encrypted payload beneath.

There are variants of course eg having ESP tunnel through using a TCP stream.

Brad