I am exploring using ipsec transport mode to provide secure ipv6 access between 2 LANs and several remote users. I love the combo of a flat ipv6 global unicast address space combined with ipv6 because you can do away with all the routing subnets that are needed for tunnels and vpns. What I don't love is that ipsec transport mode is end to end which would force me to put ipsec policy on servers on my internal lan. Is there some way to terminate ipsec transport at the firewall, and then have the cleartext packets proceed onto my internal LAN?

For reference I currently use OpenVPN for ipv4 interconnection and am tired of dealing with all the extra routing. I've not used ipsec before.


Transport mode IPsec is end-to-end by design; that's the only way it can be secure. Why would you not want to distribute the (minimal) crypto overhead across all your servers rather than at a gateway?

You can set the policies so that only internal-to-external communications are encrypted, but internal-to-internal communications are not.

If you need to inspect cross-site traffic for some reason with say an IDS/IPS, you are stuck with IPsec tunnels I'm afraid.

  • It is the management of security config that I am concerned about. It much easier to manage it all at the firewall than on a variety of servers. That said, after pondering this for some time and reading your answer, I now accept that transport IPSec is end-to-end only. Thanks. – goertzenator May 23 '12 at 14:00
  • Well, if you're using Windows servers and Active Directory, the management is all in one place, and very simple, from Certificate entrollment at each server to firewall and IPsec policies on each server in Group Policy. With Linux/other type systems, there is a lot of scripting work necessary. – rmalayter May 23 '12 at 14:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.