7.5.5 IPsec Encapsulations
Windows IPsec supports the following encapsulation modes:
Transport Mode encapsulation: Used for end-to-end IPsec encapsulation between two hosts ([RFC4303] section 3.1.1).
Tunnel Mode encapsulation: Used for an IPsec protected tunnel from a host H to a gateway G ([RFC4303] section 3.1.2).