Examkin

Question

Difficulty: HardVirtual Private Networks and Remote Access Security

A network security engineer is deploying a remote access VPN solution using L2TP over IPsec (L2TP/IPsec) to support remote workers connecting from behind residential NAT routers. Authentication will be offloaded to a central enterprise AAA server. Which of the following port and protocol configurations must be permitted on the network firewalls and VPN gateway to ensure successful connection establishment and authentication? (Select TWO.)

  1. UDP ports 500 and 4500 must be opened inbound to allow Internet Key Exchange (IKE) negotiation and IPsec NAT Traversal (NAT-T).Answer
  2. UDP port 1701 must be permitted to transport encapsulated Layer 2 Tunneling Protocol data frames.Answer
  3. C
    TCP port 1701 must be forwarded to the VPN concentrator to manage control session handshakes prior to encryption.
  4. D
    RADIUS authentication requests sent from the VPN gateway to the AAA server utilize TCP port 49 to provide full-packet payload encryption.

Answer

The correct configurations are opening UDP ports 500 and 4500 for IKE negotiation and IPsec NAT-T, and permitting UDP port 1701 for L2TP frame encapsulation.
In an L2TP/IPsec VPN deployment across NAT gateways, IPsec requires UDP port 500 for initial IKE negotiations and UDP port 4500 for NAT Traversal (NAT-T), which wraps encrypted ESP packets inside UDP headers to preserve integrity across PAT devices. Meanwhile, L2TP handles session encapsulation using UDP port 1701.

Step-by-Step Solution

1
Identify the key requirements for L2TP over IPsec tunnel establishment behind NAT.
IPsec relies on IKE (UDP port 500) for security association negotiation. Because NAT alters IP headers and breaks IPsec ESP integrity checks, NAT Traversal (NAT-T) encapsulates ESP within UDP port 4500 packets.
NAT-T allows IPsec traffic to traverse Network Address Translation (PAT) devices smoothly.
2
Determine the transport protocol and port used by L2TP.
L2TP handles multiplexing and PPP frame encapsulation over UDP port 1701.
L2TP does not use TCP; it uses UDP for low-overhead encapsulation before IPsec secures the packet payload.
3
Differentiate AAA protocol behaviors for remote user authentication.
RADIUS uses UDP ports 1812/1813 (or legacy 1645/1646) and encrypts only passwords, while TACACS+ uses TCP port 49 and encrypts the entire payload.
Confusing RADIUS and TACACS+ port assignments and encryption scope leads to incorrect firewall rules for backend AAA traffic.

Key Concept

L2TP/IPsec VPN NAT Traversal and AAA Protocol Integration
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic