Which mode of IPSec should you use to assure security and confidentiality of data within the same LAN?

IPSec's Encapsulating Security Payload (ESP) protocol provides confidentiality through encryption, as well as authentication and integrity. Transport mode is the most appropriate choice for securing communications between two hosts on the same Local Area Network (LAN). In this mode, only the IP payload (the data itself) is encrypted and/or authenticated, while the original IP header is left intact. This is efficient for end-to-end security within a trusted internal network, as it does not require the overhead of encapsulating the entire packet in a new IP header, which is characteristic of Tunnel mode.

B. ESP confidential: This is not a recognized standard IPSec mode. ESP itself provides confidentiality, but "ESP confidential" is not a formal mode of operation.

C. AH permiscuous: This is not a valid IPSec mode. "Promiscuous" refers to a network interface setting, and the Authentication Header (AH) protocol does not provide confidentiality (encryption).

D. AH Tunnel mode: The Authentication Header (AH) protocol does not provide confidentiality, which is a key requirement of the question. It only offers integrity and authentication.

1. Kent

S.

& Seo

K. (2005). Security Architecture for the Internet Protocol. RFC 4301.

Section 4.1

"Tunnel Mode vs. Transport Mode": This section details the use cases for each mode. It states

"Transport mode is used to protect traffic between hosts... Transport mode is applicable to communication between two hosts..." This supports using Transport mode for host-to-host communication within a LAN.

Section 2.2

"Security Protocols": This section describes the two security protocols

AH and ESP

noting that "ESP may be used to provide confidentiality

data origin authentication

connectionless integrity

an anti-replay service..."

2. Kent

S. (2005). IP Encapsulating Security Payload (ESP). RFC 4303.

Section 2

"ESP Packet Format": This section describes how ESP provides confidentiality by encrypting the payload data. It explicitly states

"The ESP header is inserted after the IP header and before the upper-layer protocol header... In Transport mode

the ESP header is inserted after the IP header and before an upper-layer protocol..."

3. University of California

Berkeley. (n.d.). CS 161: Computer Security

Lecture 19: Network Security.

In typical courseware on network security

the distinction is made clear. Transport mode is described as securing the payload for host-to-host communication

making it ideal for internal networks. Tunnel mode is described as securing the entire packet between gateways

typical for VPNs across untrusted networks. This lecture material reinforces that for LAN communication

Transport mode is the standard design choice.