Which reason prevents a designer from using a GDOI-based VPN to secure traffic that traverses the Internet?

Question

Options

• AEnterprise host IP addresses are typically not routable.
• BGDOI is less secure than traditional IPsec.
• CNetwork address translation functions interfere with tunnel header preservation.
• DThe use of public addresses is not supported with GDOI.

• A
  8% (4)
• B
  2% (1)
• C
  85% (44)
• D
  6% (3)

Explanation

Option C is correct because GDOI underlies Group Encrypted Transport (GET) VPN, which preserves the original IP header rather than encapsulating it in a new tunnel header. NAT modifies IP addresses in transit, which corrupts this preserved header and breaks the protocol - making Internet traversal (where NAT is nearly universal) impossible for GDOI-based VPNs.

Why the distractors are wrong:

• A is a real Internet challenge, but it's not GDOI-specific - traditional IPsec handles private host addresses fine with NAT-T, so this doesn't uniquely prevent GDOI use.
• B is false - GDOI is not less secure than traditional IPsec; GET VPN is considered a strong enterprise encryption solution.
• D reverses the actual problem - public addresses work fine with GDOI; the issue is that reaching those public addresses over the Internet requires NAT, which GDOI cannot tolerate.

Memory tip: Think of GET VPN as a "header hugger" - it clings to the original IP header. NAT is a "header changer." They're fundamentally incompatible, so GDOI stays on private WANs (like MPLS) where NAT isn't needed.

No community discussion yet for this question.