Encapsulating Security Payload (ESP) tunnel mode can encrypt the entire original Internet Protocol packet.

### Why this is right\nIn tunnel mode, ESP carries the original IP packet inside a new outer packet, and the original packet can be encrypted. The outer header remains available for routing to the peer gateway.\n\n### The concept\nThe inner packet contains the original communicating hosts' addresses. The outer packet identifies the VPN endpoints. The transit network forwards the outer packet, and the receiving gateway processes ESP and recovers the original packet.\n\n### Terms\n- **ESP**: Encapsulating Security Payload, an IPsec method that can encrypt and protect traffic.\n- **IP**: Internet Protocol, which provides addressing and packet delivery between networks.\n\n### Remember\nTunnel mode protects the original packet inside a new outer packet.