Examkin

Soru

Zorluk: Çok zorVirtual Private Networks and Remote Access Security

A network security administrator is deploying a site-to-site IPsec VPN tunnel between a branch office and central headquarters across an ISP connection where the branch router sits behind a network device performing Port Address Translation (PAT). Initial testing using Authentication Header (AH) in transport mode fails to pass traffic, whereas switching the configuration to Encapsulating Security Payload (ESP) in tunnel mode with NAT-Traversal (NAT-T) enabled allows full connectivity. Which of the following technical mechanisms explains why AH fails across a PAT-enabled device while ESP with NAT-T functions successfully?

  1. AH computes its Integrity Check Value (ICV) over immutable header fields including IP source and destination addresses, causing authentication failures when PAT mutates header fields; ESP with NAT-T encapsulates protocol packets inside UDP port 4500 headers to preserve payload integrity across translation.Cevap
  2. B
    AH operates strictly at Layer 2 as a data link frame header and cannot be routed across public IP networks, whereas ESP functions at Layer 4 using TCP port 443 to dynamically establish stateful NAT translations.
  3. C
    AH relies on stateful TCP handshakes that are dropped when PAT routers rewrite port numbers, whereas ESP uses connectionless UDP traffic exclusively to bypass stateful translation tables.
  4. D
    AH requires TCP port 50 to be statically mapped in the PAT translation table, whereas ESP uses UDP port 500 to encapsulate both control negotiations and payload data through NAT gateways.

Cevap

AH fails in a PAT environment because its Integrity Check Value (ICV) calculation incorporates the outer IP header (including IP addresses), which is altered by PAT and leads to verification failure. In contrast, ESP encapsulates payload data without hashing the outer IP header, and NAT-T wraps ESP inside UDP port 4500 headers to allow PAT routers to translate IP addresses and UDP port numbers without breaking packet integrity or firewall tracking.
The option explaining that AH includes outer IP header fields in its ICV calculation while ESP with NAT-T encapsulates traffic in UDP port 4500 is correct. Because PAT modifies IP addresses in the packet header, AH's cryptographic integrity check fails upon receipt. ESP does not include the outer IP header in its ICV, and NAT-Traversal encapsulates ESP within UDP port 4500 packets, allowing PAT devices to translate address and port headers seamlessly.

Adım Adım Çözüm

1
Analyze the scope of cryptographic integrity protection for IPsec Authentication Header (AH).
Identify that AH calculates an Integrity Check Value (ICV) over the entire IP packet, including immutable fields in the outer IP header such as Source and Destination IP addresses.
Understanding what fields are signed by AH explains why any modification to the IP packet in transit invalidates the hash.
2
Examine the impact of Port Address Translation (PAT) on packet headers.
Recognize that PAT modifies source/destination IP addresses and layer 4 port numbers on intermediate network devices.
Address translation changes header values, which directly causes the receiving peer's AH ICV check to fail.
3
Evaluate why Encapsulating Security Payload (ESP) with NAT-Traversal (NAT-T) resolves the issue.
Note that ESP does not protect the outer IP header within its ICV, and NAT-T encapsulates ESP (IP Protocol 50) inside standard UDP datagrams (UDP port 4500).
Encapsulating ESP within UDP allows PAT routers to modify outer IP and UDP headers without altering the encrypted inner payload or invalidating the ICV.

Anahtar Kavram

IPsec AH vs ESP Header Protection and NAT-Traversal (NAT-T) Mechanics
Bu soruyu puanla

Konular

Virtual Private Networks and Remote Access Security

Bu konudan daha fazla soru