An organization is deploying an enterprise remote access VPN solution for mobile users who frequently operate behind Carrier-Grade NAT (CGNAT) and restrictive corporate firewalls. The network security team requires mutual certificate authentication, complete confidentiality of internal IP headers, and seamless NAT traversal without dropping integrity checks. Which of the following technical configurations and protocol mechanisms must be selected to satisfy these requirements? (Select TWO.)
- Enable IPsec NAT-Traversal (NAT-T) to encapsulate Encapsulating Security Payload (ESP) packets within UDP port 4500 when an intermediate NAT device is detected.Cevap
- BDeploy IPsec Authentication Header (AH) in tunnel mode to provide payload encryption and maintain packet integrity across NAT gateways.
- Utilize IPsec Encapsulating Security Payload (ESP) in Tunnel mode paired with EAP-TLS to encrypt the entire inner IP packet and enforce mutual certificate authentication.Cevap
- DConfigure initial Internet Key Exchange (IKEv2) negotiations to establish Phase 1 Security Associations over TCP port 500 for guaranteed packet delivery.
Cevap
The required configurations are enabling NAT-Traversal to encapsulate ESP packets in UDP port 4500 and deploying IPsec ESP in Tunnel mode combined with EAP-TLS for full IP packet encryption and mutual certificate authentication.
The correct selection involves leveraging NAT-Traversal (NAT-T) over UDP port 4500 and deploying ESP in Tunnel mode with EAP-TLS. ESP Tunnel mode encrypts both the inner payload and the inner IP header, fulfilling the requirement for complete packet confidentiality, while EAP-TLS ensures mutual certificate authentication. NAT-T wraps ESP traffic inside standard UDP packets so stateful firewalls and CGNAT devices can properly map translation entries without invalidating cryptographic checksums.
Adım Adım Çözüm
Anahtar Kavram
IPsec Tunnel Mode vs. Transport Mode & NAT-Traversal Mechanisms