The original IP packet is not encapsulated within another IP packet, as shown in Figure 76. The entire packet can be authenticated with the Authentication Header protocol (AH), the payload can be encrypted with Encapsulating Security Payload protocol (ESP), and the original header remains in plaintext as it is sent across the WAN.
Figure 76: Transport Modes