HP-UX IPSec version A.02.00 Administrator's Guide

HP-UX IPSec Overview
Authentication Header (AH)
Chapter 132
Tunnel Mode
In tunnel mode, IPSec encloses, or encapsulates, the original IP
datagram, including the original IP header, within a second IP
datagram. All of the original IP datagram, including all fields of the
original header, is authenticated.
IPv6 In IPv6 AH tunnel mode, the packet layout is the same as IPv4 AH
tunnel mode, except that the original and new (outer) IP headers may
include header extensions.
Figure 1-3 AH in Tunnel Mode