What should be taken into consideration when designing IPsec networks using Authentication Header (AH)?

AH provides integrity and authentication by computing a hash over the entire IP packet, including immutable fields in the IP header such as source and destination addresses. Network Address Translation modifies the source IP address in transit, which invalidates the AH integrity check and causes the receiving peer to discard the packet. This fundamental incompatibility means NAT must be considered - and typically avoided or replaced with NAT-T using ESP - in any AH-based IPsec design.

Transform sets define which encryption and hashing algorithms are used in IPsec but are not a compatibility concern specific to AH.

Crypto maps are a configuration construct for applying IPsec policies and are not a design concern unique to AH.

ISAKMP governs IKE phase 1 key exchange and applies equally to both AH and ESP, so it is not a specific consideration for AH.