After NAT traversal is enabled, when a NAT device is detected between two gateways, the ESP message will be encapsulated in a UDP header. Which of the following is the source and destination port…

Question

Options

• ASource port: 4500, destination port: 4500
• BSource port: 4500, destination port: 500
• CSource port: 500, destination port:
• DSource port: 500, destination port: 4500

• A
  73% (33)
• B
  4% (2)
• C
  16% (7)
• D
  7% (3)

Explanation

When NAT-T detects a NAT device between IPsec gateways, ESP packets are encapsulated in UDP using port 4500 for both source and destination, as defined in RFC 3948. This symmetry ensures the encapsulated traffic can traverse NAT devices while being distinguishable from standard IKE traffic - both peers agree to communicate on 4500/4500 after the NAT detection handshake.

Options B and D are wrong because port 500 is reserved for IKE (Internet Key Exchange) negotiation - once NAT-T kicks in, both IKE and ESP traffic migrate away from 500 to 4500. Option C is doubly wrong: source 500 and destination 500 describes raw IKE traffic before NAT is detected, not ESP encapsulation at all.

Memory tip: Think "4500 goes both ways" - when NAT forces ESP into a UDP tunnel, it's a symmetric port pair (4500 ↔ 4500), unlike the asymmetric-looking distractors that try to mix 500 and 4500.

No community discussion yet for this question.