As shown in the figure, enterprise A and enterprise B need to communicate securely, and an IPSec tunnel is established between firewall A and firewall B. Which of the following security protocols…

Question

Options

• AAH, tunnel mode
• BESP, tunnel mode
• CESP, transmission mode
• DAH+ESP, transmission mode

• A
  4% (2)
• B
  81% (38)
• C
  4% (2)
• D
  11% (5)

Explanation

ESP in tunnel mode is the correct choice because enterprises A and B need both confidentiality (encryption) and authentication for their traffic crossing an untrusted network between two firewalls. ESP provides encryption plus integrity, and tunnel mode encapsulates the entire original IP packet-including its header-inside a new packet addressed to the firewalls, which is exactly what gateway-to-gateway VPNs require.

Option A (AH, tunnel mode) fails because AH provides only authentication and integrity-it has no encryption. "Secure communication" between enterprises implies confidentiality, which AH cannot deliver.

Option C (ESP, transport mode) fails because transport mode only encrypts the payload and leaves the original IP header exposed; it is designed for host-to-host communication, not gateway-to-gateway scenarios where the inner addresses of enterprises A and B must be hidden.

Option D (AH+ESP, transport mode) fails on both counts: transport mode is wrong for this topology (same reason as C), and combining AH+ESP in transport mode is redundant and architecturally inappropriate for inter-network firewall tunnels.

Memory tip: Think "ESP = Encryption" (ESP is the one that encrypts), and "Tunnel = Two gateways" (any time a firewall or router is acting as a VPN gateway on behalf of a whole network, you need tunnel mode to wrap the original packet in a new one).

No community discussion yet for this question.