An administrator wants to capture encrypted phase 2 traffic between two FotiGate devices using the built-in sniffer. If the administrator knows that there is no NAT device located between both…

Question

Options

• Adiagnose sniffer packet any 'udp port 500'
• Bdiagnose sniffer packet any 'lp proto 50'
• Cdiagnose sniffer packet any 'udp port 4500'
• Ddiagnose sniffer packet any 'ah'

• A
  2% (1)
• B
  84% (46)
• C
  5% (3)
• D
  9% (5)

Explanation

Option B is correct because Phase 2 IPsec traffic is carried by ESP (Encapsulating Security Payload), which is IP protocol 50 - not a UDP or TCP port. When no NAT device exists between the peers, ESP packets are sent directly without UDP encapsulation, so filtering on IP protocol 50 (ip proto 50 - the "lp" in option B is a common exam typo for "ip") captures the actual encrypted data stream.

• A (UDP 500) is wrong because port 500 is used by IKE - that's Phase 1 (key negotiation), not the encrypted Phase 2 data tunnel.
• C (UDP 4500) is wrong because port 4500 is NAT-T (NAT Traversal), which only kicks in when a NAT device is detected between peers - the question explicitly rules this out.
• D (ah) is wrong because AH (Authentication Header, protocol 51) provides integrity/authentication but not encryption; the question asks about encrypted traffic, which is ESP's job.

Memory tip: Think "No NAT → No NAT-T → Raw ESP → Proto 50." When the path is clean (no NAT), IPsec sends ESP naked on the wire as IP protocol 50 - port numbers don't enter the picture at all.

No community discussion yet for this question.