In a site-to-site Internet Protocol Security (IPsec) tunnel, the transit network forwards using the _____ Internet Protocol header.

### Why this is right\nTunnel mode adds an outer IP header whose addresses identify the VPN gateways. Transit routers use that header to deliver the protected packet across the network.\n\n### The concept\nThe original packet remains inside as the inner packet, with the communicating hosts' addresses. At the receiving VPN endpoint, the tunnel protection is processed and the original packet is recovered. This distinction separates transit forwarding from the traffic carried between sites.\n\n### Terms\n- **IPsec**: Internet Protocol Security, a set of protections for IP traffic.\n\n### Remember\nOuter addresses get the packet to the VPN peer; inner addresses identify the original communication.