transform
Function
The transform command specifies a security protocol used in an IPSec proposal.
The undo transform command restores the default configuration.
By default, an IPSec proposal uses the ESP protocol.
Parameters
| Parameter | Description | Value |
|---|---|---|
| ah | Indicates that the IPSec proposal uses the Authentication Header (AH) protocol. |
- |
| ah-esp | Indicates that the IPSec proposal encapsulates packets through ESP, then through AH. |
- |
| esp | Indicates that the IPSec proposal uses the ESP protocol. |
- |
Usage Guidelines
Usage Scenario
- In the AH mode, devices only authenticate packets.
- In the ESP mode, devices provide packet authentication, encryption, or both functions.
- In the AH-ESP mode, devices use the AH protocol to authenticate packets and the ESP protocol to encrypt packets. During IPSec encapsulation, devices encapsulate packets using ESP and then AH. During IPSec decapsulation, devices decapsulate packets using AH and then ESP.
AH prevents data tampering but cannot prevent data from being listened to, so it applies only to the transmission of non-confidential data. ESP provides authentication service inferior to that of AH, but it can encrypt packet payloads.
Precautions
The IPSec proposals configured on both ends of an IPSec tunnel must use the same security protocol.
