In IPsec which mode encapsulates the entire original IP packet inside a new packet?

• A. Transport mode
• B. IKE mode
• C. Tunnel mode
• D. Hybrid mode

Answer: (C)

Encapsulating the entire original IP packet inside a new IP packet is the behavior of IPsec Tunnel mode. In this mode, a new outer IP header is added, and the whole original IP packet—the header and payload—is encrypted and authenticated as a unit. This lets the packet travel securely across an untrusted network from one tunnel endpoint to another, while the outer header handles routing between those endpoints. The inner header stays hidden and protected, which is ideal for site-to-site VPNs or gateway-to-gateway connections.

By contrast, Transport mode keeps the original IP header intact and only protects the payload, so the routing information in the inner header remains visible. This is typically used for end-to-end protection between two hosts on a directly connected network, not for traversing multiple networks with gateways in between.

IKE is the key exchange protocol used to negotiate IPsec security associations, not a mode of encapsulation, and Hybrid mode is not a standard IPsec mode.