Cisco Collaboration endpoints are exchanging encrypted signaling messages. What is one complication in implementing NAT ALG for voice and video devices?

The correct answer is C. The NAT ALG cannot inspect the contents of encrypted signaling messages. NAT Application Layer Gateway (ALG) works by deep-inspecting signaling protocols (SIP, H.323) to find and rewrite embedded IP addresses and port information in the message body. When signaling is encrypted (e.g., over TLS), the NAT ALG cannot decrypt or read the payload, so it…

Cisco Expressway for Collaboration

Question

Options

ANAT ALG is not compatible with the H.323 signaling protocol.
BNAT ALG introduces latency in the media path.
CThe NAT ALG cannot inspect the contents of encrypted signaling messages.
DNAT ALG requires the use of NAT reflection, which may not be supported on all firewalls.

How the community answered

(28 responses)

A
7% (2)
B
4% (1)
C
86% (24)
D
4% (1)

Explanation

NAT Application Layer Gateway (ALG) works by deep-inspecting signaling protocols (SIP, H.323) to find and rewrite embedded IP addresses and port information in the message body. When signaling is encrypted (e.g., over TLS), the NAT ALG cannot decrypt or read the payload, so it cannot perform the necessary address rewrites. This makes NAT ALG ineffective for encrypted signaling, which is why traversal solutions like Cisco Expressway (which terminate and re-originate the signaling) are used instead.

Topics

#NAT ALG#Encrypted Signaling#Collaboration Security

Community Discussion

No community discussion yet for this question.

Full 300-820 Practice