IPsec Transport and Tunnel Mode

Transport Mode provides a secure connection between two endpoints as it encapsulates the IP payload. The Tunnel Mode encapsulates the entire IP packet to provide a virtual secure hop between two gateways.

Tunnel Mode forms the more familiar VPN functionality, where entire IP packets are encapsulated inside another and delivered to the destination. It encapsulates the full IP header and the payload.

Note
The UPF:UPF ICSR over IPsec works only with Tunnel Mode. Transport Mode is not supported.