Examkin

Question

Difficulty: Very hardRemote Access and Site-to-Site VPN Concepts

A network engineer is analyzing packet captures from a site-to-site IPsec VPN tunnel operating between two enterprise edge routers across an intermediate Internet Service Provider network with Port Address Translation (PAT). The captured traffic shows that Encapsulating Security Payload (ESP) is encapsulated inside UDP port 4500 packets rather than transmitted directly over IP protocol 50. Which statement correctly explains why UDP encapsulation was dynamically negotiated for this IPsec tunnel?

  1. Intermediate PAT devices require Layer 4 port numbers to multiplex traffic from multiple internal hosts, which raw IP protocol 50 headers lack.Answer
  2. B
    ESP in Tunnel mode relies on UDP port 4500 to perform Diffie-Hellman key exchanges during IKE Phase 2 renegotiations.
  3. C
    Authentication Header (AH) integration forces ESP to switch from IP protocol 50 to UDP port 4500 to allow outer header modification.
  4. D
    The intermediate PAT router strips the outer IP header, forcing IPsec to convert transport-layer framing from TCP to UDP.

Answer

Intermediate PAT devices require Layer 4 port numbers to multiplex traffic from multiple internal hosts, which raw IP protocol 50 headers lack.
ESP uses raw IP protocol 50, which does not contain TCP/UDP Layer 4 port numbers. When a NAT/PAT device sits between IPsec endpoints, it cannot multiplex multiple internal host connections onto a shared public IP address without port numbers. NAT-T dynamically detects intermediate NAT/PAT devices and encapsulates ESP packets inside UDP port 4500 headers, allowing PAT gateways to perform stateful port translation.

Step-by-Step Solution

1
Analyze the protocol characteristics of unencapsulated IPsec ESP traffic.
ESP operates directly above the IP layer as IP Protocol 50 and does not contain source or destination Layer 4 port numbers.
Without TCP or UDP port fields, a stateful Port Address Translation (PAT) device cannot track multiple internal IP address mappings to a single public IP address.
2
Identify how IPsec NAT Traversal (NAT-T) resolves PAT incompatibility.
During IKE negotiations, peers detect intermediate NAT devices and encapsulate ESP packets inside a UDP header using destination port 4500.
Adding the UDP header inserts valid Layer 4 port fields into the packet stream, enabling intermediate PAT routers to perform port translation and maintain session tables for ESP traffic.

Key Concept

IPsec NAT Traversal (NAT-T) and ESP Encapsulation Mechanics
Rate this question

Topics

Remote Access and Site-to-Site VPN Concepts

More questions from this topic