Changes

[[File:Configuration examples ipsec scheme.png]]

[[File:Configuration examples ipsec scheme.png]]

As mentioned earlier,''configuration scheme 2'' (figure above) is an extension of ''configuration scheme 1''. While ''configuration scheme 1'' only depicts a connection between two IPsec instances, you can see that in ''configuration scheme 2'' additionally contains two end devices ('''END1''' and '''END2'''), each connected to a separate router's LAN. When this scheme is realized, not only will the two routers be able to communicate with each other, the end devices will also be reachable to one another and from each router.

As mentioned earlier, ''configuration scheme 2'' (figure above) is an extension of ''configuration scheme 1''. While ''configuration scheme 1'' only depicts a connection between two IPsec instances, you can see that in ''configuration scheme 2'' additionally contains two end devices ('''END1''' and '''END2'''), each connected to a separate router's LAN. When this scheme is realized, not only will the two routers be able to communicate with each other, the end devices will also be reachable to one another and from each router.

It should also be noted the connection type used is '''Tunnel''' and not '''Transport'''. Tunnel protects the internal routing information by encrypting the IP header of the original packet. The original packet is encapsulated by a another set of IP headers. Transport encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets.

It should also be noted the connection type used is '''Tunnel''' and not '''Transport'''. Tunnel protects the internal routing information by encrypting the IP header of the original packet. The original packet is encapsulated by a another set of IP headers. Transport encrypts only the payload and Encapsulating Security Payload (ESP) trailer; so the IP header of the original packet is not encrypted. Transport mode is usually used when another tunneling protocol (such as [[VPN#GRE_Tunnel|GRE]], [[VPN#L2TP|L2TP]]) is used to first encapsulate the IP data packet, then IPsec is used to protect the GRE/L2TP tunnel packets.

===Remote LAN access===

===Remote LAN access===

----

----

First of, lets configure a simple connection between two IPsec instances, i.e., RUT1 and RUT2 as described above in configuration scheme 1.  

This section describes how to configure remote access to LAN devices via IPsec as referenced in ''[[IPsec_configuration_examples#Configuration_overview_and_prerequisites|configuration scheme 2]]''.

==Testing the setup==

==Testing the setup==