Examkin

Question

Difficulty: Very hardRemote Access and Site-to-Site VPN Concepts

A network engineer is troubleshooting an IPsec site-to-site VPN tunnel established between a main office router and a remote branch router situated behind an intermediate Port Address Translation (PAT) gateway. During tunnel negotiation, Phase 1 completes successfully, but encrypted data packets fail to pass between the sites when NAT-Traversal (NAT-T) is disabled on both gateways. Which operational characteristic of IPsec explains why the PAT gateway drops the data phase traffic?

  1. Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.Answer
  2. B
    ESP relies on TCP sliding window mechanisms to maintain state across translation tables, causing PAT devices to reject non-sequenced IKE exchanges.
  3. C
    The PAT device drops ESP traffic because dynamic translation without the overload keyword forces IPsec tunnels into unencrypted transport mode.
  4. D
    ESP encapsulation embeds TACACS+ header authentication into Phase 2 negotiations, which prevents RADIUS-based PAT state tables from tracking sessions.

Answer

Native Encapsulating Security Payload (ESP) operates directly over IP protocol 50 without Layer 4 TCP/UDP port headers, preventing PAT gateways from mapping multiple translated sessions.
The correct answer identifies that native Encapsulating Security Payload (ESP) uses IP protocol 50 without Layer 4 TCP or UDP port headers. Because Port Address Translation (PAT) relies on modifying Layer 4 port numbers to multiplex multiple private IP streams across a single public IP address, it cannot translate native ESP packets. Enabling NAT-Traversal (NAT-T) solves this issue by encapsulating ESP packets within UDP port 4500 headers, allowing PAT gateways to translate the traffic successfully.

Step-by-Step Solution

1
Analyze IPsec protocol headers for Phase 2 data plane traffic.
IPsec Encapsulating Security Payload (ESP) resides directly above the IP layer using IP protocol 50.
ESP does not contain Layer 4 source or destination port fields such as TCP or UDP.
2
Evaluate the operational mechanics of Port Address Translation (PAT).
PAT requires Layer 4 TCP or UDP port numbers to translate multiple internal IP addresses onto a single public IP address.
Without Layer 4 port identifiers, a PAT device cannot create unique translation entries in its translation table.
3
Determine the impact of disabling NAT-Traversal (NAT-T).
Without NAT-T, ESP packets are sent in their native format (IP protocol 50) rather than being encapsulated inside UDP port 4500 wrappers.
The intermediate PAT device cannot translate native ESP packets, causing Phase 2 data traffic to be dropped.

Key Concept

IPsec NAT-Traversal (NAT-T) and ESP Encapsulation Mechanics
Rate this question

Topics

Remote Access and Site-to-Site VPN Concepts

More questions from this topic