A network tunnel is a virtual communication pathway that carries encapsulated traffic across an underlying network. In a site-to-site IPsec VPN, routers use the tunnel to protect communication between remote sites over the public internet; the tunnel is virtual, not a separate physical route. section 16.3.1
An IPsec tunnel processes traffic in this sequence:
- R1 encrypts the original packet, hiding its contents and intended destination. section 16.3.1
- R1 encapsulates the encrypted packet inside a new packet addressed to R2 and forwards it across the internet. section 16.3.1
- R2 de-encapsulates and decrypts the inner packet, then forwards it to the destination host. section 16.3.1
Site-to-site communication
Hosts at one site send ordinary, unencrypted traffic to R1. R1 encrypts and tunnels it to R2, allowing R2 to deliver it to a remote server without requiring the hosts to create VPN connections themselves. section 16.3.1
Figure 16.14 A tunnel is created by encapsulating a packet inside of another packet. This outer packet provides a “tunnel” for the inner packet to travel through without being exposed to the internet.
Visualizes encapsulation by showing an inner packet carried inside an outer packet that provides the tunnel across the internet. section 16.3.1
