Examkin

Question

Difficulty: MediumVirtual Private Networks and Remote Access Security

A network administrator is setting up a site-to-site IPsec VPN connection between a branch office router and the headquarters firewall. The branch office router is situated behind an ISP border device that performs Network Address Translation (NAT). During testing, the administrator notes that IPsec Encapsulating Security Payload (ESP) packets are dropped when traversing the NAT gateway because address translation alters packet headers and breaks cryptographic integrity checks. Which feature should be configured to encapsulate the IPsec traffic and allow successful traversal across the NAT device?

  1. NAT Traversal (NAT-T) using UDP port 4500Answer
  2. B
    IPsec Authentication Header (AH) using TCP port 443
  3. C
    Point-to-Point Tunneling Protocol (PPTP) using TCP port 500
  4. D
    Layer 2 frame wrapping using untagged 802.1Q trunking

Answer

NAT Traversal (NAT-T) using UDP port 4500
NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams using destination port UDP 4500. This allows routers performing Network Address Translation (NAT) to rewrite outer header IP addresses and ports without altering or corrupting the inner encrypted IPsec ESP packet, successfully preserving payload integrity checks.

Step-by-Step Solution

1
Analyze why standard IPsec ESP fails across Network Address Translation (NAT) devices.
NAT alters source/destination IP addresses and port numbers in packet headers, which invalidates IPsec cryptographic checksums.
IPsec security mechanisms are designed to detect any modification of packet headers in transit as tampering.
2
Identify the standard protocol enhancement designed to resolve IPsec NAT incompatibilities.
NAT Traversal (NAT-T) detects NAT gateways during IKE negotiations and wraps ESP packets within UDP headers.
Encapsulating ESP in UDP port 4500 allows intermediate NAT devices to modify the outer UDP/IP headers while preserving the inner encrypted IPsec payload intact.

Key Concept

IPsec NAT Traversal (NAT-T) and UDP Port Encapsulation
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic