IPsec vs TLS VPN: tunnel mode, transport mode, split tunneling
IPsec protects traffic at the network layer, using ESP to encrypt and IKE to negotiate keys, and is used for both site-to-site and remote access VPNs. A TLS VPN, still often called an SSL VPN, carries traffic inside TLS, usually on port 443. Either way, the VPN protects traffic only between the client or branch and the VPN gateway.
IPsec parts and modes
IPsec has two main parts. Encapsulating Security Payload (ESP) carries the encrypted, integrity-protected traffic. Internet Key Exchange (IKE) authenticates the endpoints and negotiates the session keys. The older Authentication Header (AH) gives integrity without encryption, and NIST SP 800-77 Rev. 1 no longer recommends it.
In tunnel mode, ESP encrypts the whole original packet, including its IP header, and adds a new outer IP header that names the tunnel endpoints, such as the two gateways. An eavesdropper sees only those gateway addresses. Tunnel mode is used for gateway-to-gateway and remote access VPNs and works through NAT.
In transport mode, ESP keeps the original IP header and encrypts only the payload, so the real source and destination stay visible. It is mostly used host to host inside data centers and does not work through NAT.
TLS VPNs
TLS has a handshake protocol that authenticates the parties and agrees keys, and a record protocol that protects the traffic with those keys (RFC 8446). A TLS VPN is harder to block than IPsec because it can run on any port, usually 443. NIST notes that over TCP it can slow badly when packets are lost, and that it usually runs as an application, so it is slower than kernel-based VPNs such as IPsec.
What a VPN does not protect
NIST SP 800-46 Rev. 2 says a tunnel protects traffic between the client device and the VPN gateway but not between the gateway and internal servers. Encrypted traffic also cannot be read by firewalls or intrusion detection systems, so sensors that need to inspect it go behind the gateway, where it is decrypted.
Split tunneling sends only traffic for internal resources through the VPN and lets everything else go straight to the internet. It reduces load on the gateway, but the organization can no longer inspect or protect that other traffic. NIST advises considering disabling it for teleworkers on untrusted networks such as hotspots.
Where the exam catches people
Believing a site-to-site tunnel hides every address: in tunnel mode the outer header shows the two gateway addresses; only the inner addresses, ports and payload are encrypted.
Believing the VPN encrypts traffic all the way to the server: protection ends at the VPN gateway, so the internal leg needs its own encryption.
Believing split tunneling leaves internal traffic unencrypted: internal traffic still goes through the tunnel; the risk is the internet traffic the organization can no longer inspect.
Believing AH encrypts data: AH gives integrity only, and NIST no longer recommends it; ESP provides encryption.
Believing transport mode is the site-to-site choice: gateway-to-gateway VPNs use tunnel mode, which also works through NAT.