Examkin

Soru

Zorluk: ZorVirtual Private Networks and Remote Access Security

A network engineer is configuring an IPsec site-to-site VPN connection across the Internet between a corporate headquarters router with a static public IP address and a branch office router situated behind a carrier-grade Network Address Translation (CGNAT) gateway. During initial deployment testing, IKEv2 Phase 1 negotiation completes successfully, but IPsec Phase 2 fails to pass encrypted data traffic across the tunnel, resulting in integrity check failure drops on the receiving router. Troubleshooting reveals that the security policy was configured using Authentication Header (AH) in transport mode. Which modification to the VPN configuration will resolve the transmission failure while ensuring payload encryption and data integrity across the NAT boundary?

  1. Switch the security protocol from Authentication Header (AH) to Encapsulating Security Payload (ESP) and enable NAT Traversal (NAT-T) using UDP port 4500.Cevap
  2. B
    Retain Authentication Header (AH) but change the IPsec mode from transport mode to tunnel mode to encapsulate the original IP header.
  3. C
    Reconfigure IKE Phase 1 to negotiate over TCP port 500 instead of UDP port 500 so stateful NAT gateways can inspect payload integrity.
  4. D
    Migrate the remote authentication framework from RADIUS on UDP port 1812 to TACACS+ on TCP port 49 to encrypt the IPsec header.

Cevap

The VPN configuration must be updated to use Encapsulating Security Payload (ESP) instead of Authentication Header (AH), alongside enabling NAT Traversal (NAT-T) on UDP port 4500.
The correct response recommends replacing Authentication Header (AH) with Encapsulating Security Payload (ESP) and using NAT Traversal (NAT-T) on UDP port 4500. AH validates the integrity of the outer IP header fields; because NAT modifies IP address headers in transit, AH integrity verification always fails across a NAT boundary. ESP encrypts the payload and does not include the outer IP header in its checksum. When NAT-T is enabled, ESP packets are encapsulated inside UDP port 4500 datagrams, allowing NAT devices to multiplex and translate the connection via standard Port Address Translation (PAT).

Adım Adım Çözüm

1
Analyze why Authentication Header (AH) fails when passing through a Network Address Translation (NAT) device.
AH computes an Integrity Check Value (ICV) over the IP header fields (including source/destination IP addresses). When NAT modifies these address fields in transit, the receiving endpoint recalculates a mismatched ICV, causing packet drops.
AH does not support NAT traversal because it protects the IP header against modification.
2
Evaluate protocol options for confidentiality and NAT compatibility.
Encapsulating Security Payload (ESP) provides confidentiality (encryption) and integrity for the payload without including the outer IP header in its ICV calculation.
ESP allows NAT modifications to outer IP headers without invalidating the cryptographic checksum of the encrypted inner payload.
3
Determine the required mechanism for passing raw IPsec ESP packets through NAT routers.
Enable NAT Traversal (NAT-T), which detects NAT devices during IKE Phase 1 and encapsulates protocol 50 (ESP) packets inside standard UDP port 4500 datagrams.
NAT devices frequently drop raw ESP (IP protocol 50) packets due to lack of L4 port numbers required for PAT/NAT table tracking.

Anahtar Kavram

IPsec Protocols (AH vs ESP) and NAT Traversal (NAT-T)
Bu soruyu puanla

Konular

Virtual Private Networks and Remote Access Security

Bu konudan daha fazla soru