Examkin

Question

Difficulty: HardVirtual Private Networks and Remote Access Security

An organization deploys a client-based IPsec VPN solution for remote system administrators. During initial deployment testing, users connecting from home networks behind Network Address Translation (NAT) devices experience immediate packet drops when using IPsec with Authentication Header (AH). However, changing the VPN configuration to use Encapsulating Security Payload (ESP) resolves the issue and allows full connectivity. Which of the following best explains why the AH configuration failed in this scenario?

  1. Authentication Header includes the outer IP header in its Integrity Check Value calculation, causing cryptographic validation failure when NAT modifies the IP address.Answer
  2. B
    Authentication Header relies exclusively on TCP port 500 for key negotiation, which cannot be translated by PAT routers that only perform UDP port mapping.
  3. C
    Authentication Header encapsulates data at OSI Layer 2, preventing it from being routed across Layer 3 public network boundaries without GRE.
  4. D
    Authentication Header encrypts authentication credentials using TACACS+ headers, which PAT gateways rewrite and corrupt during IP address overload translation.

Answer

Authentication Header (AH) includes the outer IP header in its ICV integrity calculation, causing packet drops when a NAT router modifies the source/destination IP address.
The correct answer identifies that IPsec Authentication Header (AH) includes the outer IP header in its integrity hash calculation. When a NAT router translates the IP address, the header modification invalidates the cryptographic checksum, causing the recipient IPsec endpoint to drop the packet. Switching to Encapsulating Security Payload (ESP) avoids this because ESP does not include the outer IP header in its ICV.

Step-by-Step Solution

1
Analyze the functional difference between IPsec Authentication Header (AH) and Encapsulating Security Payload (ESP).
AH provides integrity and authentication for the entire IP packet (including outer IP headers), whereas ESP provides confidentiality and integrity primarily for the payload.
Understanding which packet header fields are covered by cryptographic integrity checks is necessary to evaluate NAT compatibility.
2
Evaluate the effect of Network Address Translation (NAT) on IP headers.
NAT alters IP header fields by modifying the source or destination IP addresses.
Routers performing NAT must mutate packet headers to route traffic between private and public IP address spaces.
3
Correlate NAT modifications with AH integrity verification.
Because AH calculates its Integrity Check Value (ICV) over immutable and mutable IP header fields, changing the IP address breaks the ICV validation at the receiving gateway.
The receiver recalculates the ICV upon arrival; since NAT changed the header, the calculated hash does not match the transmitted hash, leading to dropped packets unless ESP with NAT-Traversal (NAT-T) is utilized.

Key Concept

IPsec AH vs ESP NAT Incompatibility
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic