Examkin

Soru

Zorluk: Çok zorRemote Access and Site-to-Site VPN Concepts

A network engineer is analyzing packet captures from a site-to-site IPsec VPN tunnel operating between two enterprise edge routers across an intermediate Internet Service Provider network with Port Address Translation (PAT). The captured traffic shows that Encapsulating Security Payload (ESP) is encapsulated inside UDP port 4500 packets rather than transmitted directly over IP protocol 50. Which statement correctly explains why UDP encapsulation was dynamically negotiated for this IPsec tunnel?

  1. Intermediate PAT devices require Layer 4 port numbers to multiplex traffic from multiple internal hosts, which raw IP protocol 50 headers lack.Cevap
  2. B
    ESP in Tunnel mode relies on UDP port 4500 to perform Diffie-Hellman key exchanges during IKE Phase 2 renegotiations.
  3. C
    Authentication Header (AH) integration forces ESP to switch from IP protocol 50 to UDP port 4500 to allow outer header modification.
  4. D
    The intermediate PAT router strips the outer IP header, forcing IPsec to convert transport-layer framing from TCP to UDP.

Cevap

Intermediate PAT devices require Layer 4 port numbers to multiplex traffic from multiple internal hosts, which raw IP protocol 50 headers lack.
ESP uses raw IP protocol 50, which does not contain TCP/UDP Layer 4 port numbers. When a NAT/PAT device sits between IPsec endpoints, it cannot multiplex multiple internal host connections onto a shared public IP address without port numbers. NAT-T dynamically detects intermediate NAT/PAT devices and encapsulates ESP packets inside UDP port 4500 headers, allowing PAT gateways to perform stateful port translation.

Adım Adım Çözüm

1
Analyze the protocol characteristics of unencapsulated IPsec ESP traffic.
ESP operates directly above the IP layer as IP Protocol 50 and does not contain source or destination Layer 4 port numbers.
Without TCP or UDP port fields, a stateful Port Address Translation (PAT) device cannot track multiple internal IP address mappings to a single public IP address.
2
Identify how IPsec NAT Traversal (NAT-T) resolves PAT incompatibility.
During IKE negotiations, peers detect intermediate NAT devices and encapsulate ESP packets inside a UDP header using destination port 4500.
Adding the UDP header inserts valid Layer 4 port fields into the packet stream, enabling intermediate PAT routers to perform port translation and maintain session tables for ESP traffic.

Anahtar Kavram

IPsec NAT Traversal (NAT-T) and ESP Encapsulation Mechanics
Bu soruyu puanla

Konular

Remote Access and Site-to-Site VPN Concepts

Bu konudan daha fazla soru