Modo de transporte:
No modo transporte, somente a mensagem (payload) é criptografada. O roteamento permanece intacto, desde que o cabeçalho do IP não seja modificado e nem cifrado; entretanto, quando o cabeçalho da autenticação é usado, os endereços IP não podem ser traduzidos, porque isto invalida o valor de hash. As camadas de transporte e de aplicação são fixas sempre pelo hash, assim, não podem sofrer nenhuma modificação. O modo transporte é usado para comunicações de host-a-host.
Modo de tunelamento:
No modo de tunelamento, o pacote IP é criptografado por inteiro. Deve, assim, encapsular um novo pacote IP para distribuí-lo. O tunelamento é usado para comunicações da rede-a-rede (túneis seguros entre roteadores) ou comunicações de host-a-rede e de host-a-host sobre a inter
b-
IPsec uses cryptographic security services to protect communications over Internet Protocol (IP) networks. As a part of the IPv4 enhancement, IPsec is a layer 3 OSI model or internet layer end-to-end security scheme.
The IPsec is an open standard as a part of the IPv4 suite. IPsec uses the following protocols to perform various functions:
1- Authentication Headers (AH) provides connectionless data integrity and data origin authentication for IP datagrams and provides protection against replay attacks.
2- Encapsulating Security Payloads (ESP) provides confidentiality
3- Internet Security Association and Key Management Protocol (ISAKMP) provides a framework for authentication and key exchange, with actual authenticated keying material provided either by manual configuration with pre-shared keys, Internet Key Exchange (IKE and IKEv2), Kerberized Internet Negotiation of Keys (KINK), or IPSECKEY DNS records.
IPsec support is an optional add-on in IPv4, but is a mandatory part of IPv6.
The IPsec protocols AH and ESP can be implemented in a host-to-host transport mode, as well as in a network tunneling mode.
Transport mode - only the payload of the IP packet is usually encrypted or authenticated. The routing is intact, since the IP header is neither modified nor encrypted. The transport and application layers are always secured by a hash, so they cannot be modified in any way, for example by translating the port numbers.
Tunnel mode - the entire IP packet is encrypted and authenticated, then encapsulated into a new IP packet with a new IP header. Tunnel mode is used to create virtual private networks for network-to-network communications (e.g. between routers to link sites), host-to-network communications (e.g. remote user access) and host-to-host communications (e.g. private chat).
https://en.wikipedia.org/wiki/IPsec#Algorithms