IPv6, 2nd Edition

Chapter 6 • The IP Security Protocol (IPsec) 119

payload—thus, the ESP Next Header field is placed after rather than before

the payload.

ESP’s authentication service covers only the payload itself, not the IP

headers of its own packet as with the Authentication Header. And the

confidentiality service covers only the payload itself; obviously, you can’t

encrypt the IP headers of the packet intended to deliver the payload and

still expect any intermediate routers to be able to process the packet. Of

course, if you’re using tunneling, you can encrypt everything, but only

everything in the tunneled packet itself.

6.6 Implementing and Deploying IPsec

IP layer ...