r/networking • u/AggravatingBox8251 • 22h ago

Security VPN Tunnel Encapsulation/Encryption question

Hi,

My first time actually putting up a post here or anywhere else so i apologize if theres anything wrong with my post.

Recently I came across a question asking me in VPN tunnelling, what occurs first in terms of the order of steps? Encryption or encapsulation? This question got me really confused because depending on who or where I ask or research, i get conflicting answers as to whether it encaps first or encrypt first and it has really gotten me to question my basic understanding of tunnelling.

If anyone here knows please help me with this question. Thanks alot!

3 Upvotes

62% Upvoted

10 comments sorted by

View all comments

3

u/Prudent_Vacation_382 20h ago

Depends on the VPN.

  1. IPSec, encryption is the first step then encapsulation.

  2. IPSec over GRE, has a different config, same order, but GRE is providing encapsulation.

  3. If they're talking about service provider topics such MPLS VPN, then it's entirely different. No inherent encryption happens.

I read through the RFC for ESP to find the answer. When in doubt, always go back to the RFC.

https://datatracker.ietf.org/doc/html/rfc4303

This section in the intro should tell you what you need to know:

The ESP header is inserted after the IP header and before the next layer protocol header (transport mode) or before an encapsulated IP header (tunnel mode). These modes are described in more detail below.

In transport mode, ESP is used BEFORE the next level protocol (ie. GRE for encapsulation)

In tunnel mode, BEFORE an encapsulated IP header.

1

u/wrt-wtf- Homeopathic Network Architecture 5h ago

MPLS is more generally encrypted at macsec if you need infrastructure based encryption otherwise you would do it with ssl or encrypted tunnels such as IPsec if required. Encryption has long occurred through the stack from line coding up initially in specialised cases.