Which feature or technology that affects the operations of IPsec should be taken into account when designing an IPsec network using Authentication header?

Question

Options

• ATCP MSS adjustment
• BCertificate-based authentication
• CTransform set
• DNAT

• A
  13% (6)
• B
  4% (2)
• C
  8% (4)
• D
  75% (36)

Explanation

NAT is the correct answer because IPsec's Authentication Header (AH) computes an integrity check over the entire IP packet, including the source and destination IP addresses in the outer header. When NAT modifies those addresses in transit, the AH hash no longer matches at the receiving end, causing the packet to be dropped - making AH fundamentally incompatible with NAT. This is why ESP with NAT-T is used instead of AH in environments with NAT devices.

Why the distractors are wrong:

• A (TCP MSS adjustment): This addresses fragmentation/MTU overhead added by IPsec encapsulation - a concern for both AH and ESP, but not a feature that breaks AH specifically.
• B (Certificate-based authentication): This is an IKE peer authentication method (an alternative to pre-shared keys) and doesn't conflict with or impact how AH functions once the tunnel is established.
• C (Transform set): Transform sets are part of the IPsec configuration itself (defining which protocols/algorithms to use), not an external network feature that disrupts AH operation.

Memory tip: Think "AH = Authenticates Headers" - since AH signs the IP header, anything that touches the IP header (NAT) will break AH. If your network has NAT, AH is a non-starter.

No community discussion yet for this question.