Examkin

Question

Difficulty: Very hardVirtual Private Networks and Remote Access Security

An enterprise network administrator is deploying a site-to-site IPsec VPN between a corporate headquarters and a remote branch office. The branch office router is positioned behind a service provider gateway performing Port Address Translation (PAT). Diagnostic logs confirm that Phase 1 (IKE) authentication succeeds over UDP port 500. However, Phase 2 fails to establish a functional data tunnel. Further analysis reveals that the security policy is configured to use IPsec Authentication Header (AH) in tunnel mode. Which of the following root causes best explains why the IPsec VPN tunnel fails to operate across the PAT gateway?

  1. IPsec AH calculates an Integrity Check Value across the entire IP header, causing integrity validation failures at the destination because PAT modifies header fields during translation.Answer
  2. B
    IPsec AH operates exclusively at Layer 4 of the OSI model, making it incapable of encapsulating Layer 3 IP headers required for site-to-site routing across public networks.
  3. C
    Phase 2 tunnel negotiation requires TCP port 500 for stateful session establishment, which is blocked by the PAT gateway's default session table behavior.
  4. D
    The main office firewall requires IPsec AH traffic to be encapsulated within TCP port 443 to bypass PAT devices, rather than using standard IPsec protocol numbers.

Answer

IPsec AH calculates an Integrity Check Value across the entire IP header, causing integrity validation failures at the destination because PAT modifies header fields during translation.
The correct answer identifies that IPsec Authentication Header (AH) computes its Integrity Check Value (ICV) over the entire IP packet, including header fields like IP addresses and ports. When a PAT gateway modifies these fields to route packets across public subnets, the receiver recalculates the ICV and detects a discrepancy, dropping the traffic. AH is fundamentally incompatible with NAT/PAT for this reason.

Step-by-Step Solution

1
Analyze the VPN protocol suite and operational mode specified in the scenario.
Identified that the setup uses IPsec Authentication Header (AH) in tunnel mode across a Port Address Translation (PAT) boundary.
Understanding the cryptographic scope of IPsec AH vs ESP is critical for identifying NAT compatibility issues.
2
Evaluate how Port Address Translation (PAT) modifies IP packets in transit.
PAT modifies the source/destination IP addresses and transport layer port numbers in the outer IP header.
Translating private IP addresses to public IP addresses requires header modification by the NAT/PAT gateway.
3
Determine the cryptographic coverage of IPsec Authentication Header (AH).
AH computes an Integrity Check Value (ICV) over the entire packet, including non-mutable and mutable fields in the outer IP header.
Because PAT alters IP header fields after the sender calculates the ICV, the receiver's ICV calculation fails, causing the packet to be rejected.
4
Identify the correct remediation standard according to Network+ core security objectives.
Migrate from AH to Encapsulating Security Payload (ESP) with NAT-Traversal (NAT-T) enabled over UDP port 4500.
ESP protects the payload payload and leaves mutable outer IP headers unauthenticated, enabling seamless NAT/PAT traversal when encapsulated in UDP packets.

Key Concept

IPsec AH vs ESP Cryptographic Scope and NAT Traversal Compatibility
Rate this question

Topics

Virtual Private Networks and Remote Access Security

More questions from this topic