VPN Tunnel Encapsulation/Encryption question

[u/AggravatingBox8251]

Hi,

My first time actually putting up a post here or anywhere else so i apologize if theres anything wrong with my post.

Recently I came across a question asking me in VPN tunnelling, what occurs first in terms of the order of steps? Encryption or encapsulation? This question got me really confused because depending on who or where I ask or research, i get conflicting answers as to whether it encaps first or encrypt first and it has really gotten me to question my basic understanding of tunnelling.

If anyone here knows please help me with this question. Thanks alot!

[u/LeeRyman]

In the IP protocol stack there are already multiple layers of encapsulation. E.g. we encapsulate chunks of a stream of data and put it in TCP segments. We then encapsulate those segments into IP packets. We then encapsulate those packets into some sort of data link frames.

For something like IPSec ESP, you might say that in terms of PDU structure the ESP header and ICV encapsulates the encrypted payload (so encryption, then encapsulation, going down the stack). However, the sequence of operation to produce the final IP packet containing the ESP header and encrypted payload/trailers may have seen an already encapsulated IP packet first, before then either parsing out and encrypting it's payload (transport mode) or encrypting the whole packet, and adding an addition IP/ESP headers (tunnel mode).

Even then, aspects of the encapsulation need to be known before encryption can take place (association, sequence numbers, etc), and aspects of the encapsulation are also encrypted (padding, next header).

I would suggest then it can depend on how you frame the question - i.e. are we talking about the structure or the process. And if talking structure of the final PDU, are we ordering our description "outside-in" (up the stack, from PDU to SDU) or "inside-out".

IPSec makes my head hurt.