1

I am creating a scenario in Packet tracer where i have two routers, and i have established an IPsec tunnel between them using ESP protocol, as show below,

enter image description here

I have changed the packet tracer mode to simulation to test how ESP is working to encapsulate data when I access server from PC0.

I accessed the webserver (192.168.2.3) from PC0 (192.168.1.2) and examine the packet at R0 and I got the following output,

Inbound PDU,

enter image description here

In the above diagram, I don't understand why the source and destination address are not encapsulated ? shouldn't they be changed to the router's address. Because if there is an eavesdropper at R0, he can easily see the destination of the packet.

now at Outbound PDU,

enter image description here

How come there are two different IP Packets, and why there is still un-encapsulated IP address in outbound packet.

Can anyone please explain ?

Improve this question
1
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide your own answer and accept it.
    – Ron Maupin ♦
    Commented Aug 7, 2017 at 14:06

1 Answer 1

Reset to default
3

It's quite obvious.

For inbound traffic, the packet analyzer shows you already decapsulated traffic. That's why you're seeing real IPs in the header, so essentially it's already decrypted.

For outbound traffic, there's new external IP header with ESP, and the IPs seems to be endpoints of IPsec tunnel judging by the topology drawing. Then, there's internal IP header that's original one, carried over and encapsulated over the ESP header.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.