Editing IPsec (section)

===Transport mode===
In transport mode, only the payload of the IP packet is usually [[encrypted]] or authenticated. The routing is intact, since the IP header is neither modified nor encrypted; however, when the [[Authentication Header|authentication header]] is used, the IP addresses cannot be modified by [[network address translation]], as this always invalidates the [[hash value]]. The [[transport layer|transport]] and [[application layer|application]] layers are always secured by a hash, so they cannot be modified in any way, for example by [[port address translation|translating]] the [[TCP and UDP port|port]] numbers.

A means to encapsulate IPsec messages for [[NAT traversal]] (NAT-T) has been defined by [[Request for Comments|RFC]] documents describing the NAT-T mechanism.