200-301: Cisco Certified Network AssociateDemo

Tunnel mode is used when the IPsec endpoint that applies security is not the packet’s ultimate destination. It encapsulates the entire original IP packet inside a new IP packet whose outer header is addressed to the security gateway or tunnel endpoint. Transport mode is for cases where the communicating hosts themselves are the IPsec endpoints, while main mode and aggressive mode are IKE negotiation modes rather than IPsec encryption modes.