Examkin

Soru

Zorluk: OrtaVirtual Private Networks and Remote Access Security

A network administrator is setting up a site-to-site IPsec VPN connection between a branch office router and the headquarters firewall. The branch office router is situated behind an ISP border device that performs Network Address Translation (NAT). During testing, the administrator notes that IPsec Encapsulating Security Payload (ESP) packets are dropped when traversing the NAT gateway because address translation alters packet headers and breaks cryptographic integrity checks. Which feature should be configured to encapsulate the IPsec traffic and allow successful traversal across the NAT device?

  1. NAT Traversal (NAT-T) using UDP port 4500Cevap
  2. B
    IPsec Authentication Header (AH) using TCP port 443
  3. C
    Point-to-Point Tunneling Protocol (PPTP) using TCP port 500
  4. D
    Layer 2 frame wrapping using untagged 802.1Q trunking

Cevap

NAT Traversal (NAT-T) using UDP port 4500
NAT Traversal (NAT-T) encapsulates IPsec ESP packets inside UDP datagrams using destination port UDP 4500. This allows routers performing Network Address Translation (NAT) to rewrite outer header IP addresses and ports without altering or corrupting the inner encrypted IPsec ESP packet, successfully preserving payload integrity checks.

Adım Adım Çözüm

1
Analyze why standard IPsec ESP fails across Network Address Translation (NAT) devices.
NAT alters source/destination IP addresses and port numbers in packet headers, which invalidates IPsec cryptographic checksums.
IPsec security mechanisms are designed to detect any modification of packet headers in transit as tampering.
2
Identify the standard protocol enhancement designed to resolve IPsec NAT incompatibilities.
NAT Traversal (NAT-T) detects NAT gateways during IKE negotiations and wraps ESP packets within UDP headers.
Encapsulating ESP in UDP port 4500 allows intermediate NAT devices to modify the outer UDP/IP headers while preserving the inner encrypted IPsec payload intact.

Anahtar Kavram

IPsec NAT Traversal (NAT-T) and UDP Port Encapsulation
Bu soruyu puanla

Konular

Virtual Private Networks and Remote Access Security

Bu konudan daha fazla soru