Your VPN encrypts traffic. But does it encrypt the right things?
This is a question most network engineers never ask — until it's too late.
IPSec is the backbone of enterprise VPN security. But there's a critical configuration decision hiding inside every IPSec deployment that can silently undermine your security posture: Transport Mode vs Tunnel Mode.
And I still see this mistake in production environments every week.
Transport Mode: encryption with a blind spot
In Transport Mode, IPSec encrypts only the payload of the IP packet. The original IP header — source address, destination address, protocol type — remains fully visible in plaintext.
What does this mean in practice?
An attacker positioned as a Man-in-the-Middle doesn't need to break your encryption to gain valuable intelligence. With passive observation alone, they can map: - Which internal hosts are communicating - Communication frequency and timing patterns - Traffic volume between specific endpoints - Application protocols in use
This is traffic metadata analysis — one of the most powerful passive reconnaissance techniques available. In a targeted attack, knowing that Host A communicates heavily with Host B at specific hours is actionable intelligence, even without decrypting a single byte of payload.
Transport Mode was designed for host-to-host communication where both endpoints are the actual source and destination. It has legitimate use cases — but they are far narrower than most real-world deployments suggest.
Tunnel Mode: full encapsulation
In Tunnel Mode, IPSec encapsulates the entire original IP packet — header included — inside a new outer IP packet, then encrypts the whole thing.
From an observer's perspective, they see only the VPN gateway addresses and an encrypted blob. Your internal network topology, host identities, and communication patterns are completely hidden.
This is why Tunnel Mode is the mandatory choice for site-to-site VPN connections and remote access deployments where protecting network-level metadata is non-negotiable.
The real-world impact
Most IPSec misconfigurations aren't deliberate. They come from following default settings or outdated deployment guides without fully understanding the underlying security model.
A penetration tester with passive network access can map your internal infrastructure's communication patterns within hours — using only Transport Mode metadata, without breaking a single cipher.
What to audit today
Review all IPSec policies: confirm Transport vs Tunnel Mode on each connection Verify every site-to-site VPN runs Tunnel Mode Check IKE configurations — weak DH groups (Group 1, 2, 5) are still prevalent Confirm PFS (Perfect Forward Secrecy) is enabled on all IKE phase 2 settings
Your VPN is only as secure as its weakest configuration choice.