A network security administrator is troubleshooting a remote access IPsec VPN deployment across a router performing Network Address Translation (NAT). During testing, site-to-client connections configured to use IPsec Authentication Header (AH) fail to establish, whereas connections configured to use Encapsulating Security Payload (ESP) succeed. Which of the following best explains why IPsec AH fails when passing through a NAT device?
- AH includes the outer IP header fields when calculating its integrity checksum, causing header modifications made by NAT to invalidate the packet authentication.Answer
- BAH relies exclusively on TCP port 443 for packet transport, which prevents the NAT device from creating dynamic translation table entries.
- CAH operates at the Data Link layer (Layer 2) of the OSI model, making it incompatible with Layer 3 network address rewriting.
- DAH defaults to using UDP port 22 for secure authentication, which is systematically dropped by standard NAT-enabled firewalls.
Answer
IPsec Authentication Header (AH) calculates its integrity checksum over the outer IP header fields, so Network Address Translation (NAT) modifications cause authentication verification failure at the receiving endpoint.
IPsec Authentication Header (AH) provides connectionless integrity and authentication by calculating an Integrity Check Value (ICV) over the entire IP packet, including mutable fields such as the source and destination IP addresses in the outer header. When Network Address Translation (NAT) modifies the IP header, the ICV check fails at the receiver. In contrast, Encapsulating Security Payload (ESP) does not include the outer IP header in its ICV calculation, enabling compatibility with NAT Traversal (NAT-T).
Step-by-Step Solution
Key Concept
IPsec Authentication Header (AH) vs Encapsulating Security Payload (ESP) NAT Traversal Compatibility