Chapter17 IP Security
IPSec Rules
17-20
Cisco Router and Security Device Manager 2.5 User’s Guide
OL-4015-12

Mode

Select which parts of the traffic you want to encrypt:
•Transport. Encrypt data only—Transport mode is used when both endpoints
support IPsec; this mode places the AH or ESP after the original IP header;
thus, only the IP payload is encrypted. This method allows users to apply
network services such as quality-of-service (QoS) controls to encrypted
packets. Transport mode should be used only when the destination of the data
is always the remote VPN peer.
•Tunnel. Encrypt data and IP header—Tunnel mode provides stronger
protection than transport mode. Because the entire IP packet is encapsulated
within AH or ESP, a new IP header is attached, and the entire datagram can
be encrypted. Tunnel mode allows network devices such as a router to act as
an IPsec proxy for multiple VPN users; tunnel mode should be used in those
configurations.

IP Compression (COMP-LZS)

Check this box if you want to use data compression.
Note Not all routers support IP compression. If your rout er does not support IP
compression, this box is disabled.
IPSec Rules
This window shows the IPSec rules configured for this router. IPSec rules define
which traffic IPSec will encrypt. The top part of the window lists the access rules
defined. The bottom part shows the access rule entries for the access rule selected
in the rule list.
IPSec rules contain IP address and type-of-service information. Packets that
match the criteria specified in the rule are encrypted. Packets that do not match
the criteria are sent unencrypted.

Name/Num

The name or number of this rule.