Use IKE v1 main mode to establish an IPSec VPN. After detecting the presence of a NAT device, which of the following ISAKMP messages will be followed by port number conversion?

Question

Options

• AMessage 5
• BMessage 6
• CMessage 3
• DMessage 4

• A
  72% (34)
• B
  17% (8)
• C
  4% (2)
• D
  6% (3)

Explanation

In IKE v1 Main Mode, NAT detection uses NAT-D (NAT Detection) payloads, which are exchanged during Messages 3 and 4 (the Diffie-Hellman key exchange phase). Once both peers confirm a NAT device is present after Message 4, they float from UDP port 500 to UDP port 4500 beginning with Message 5 - making Message 5 the first message subject to port number conversion.

Why the distractors are wrong:

• D (Message 4): This is where NAT detection completes, but the port switch takes effect on the next message, not Message 4 itself.
• C (Message 3): NAT-D payloads begin here, but detection isn't confirmed yet - no port conversion occurs.
• B (Message 6): Message 6 also uses port 4500, but Message 5 precedes it, so 6 is not the first to undergo conversion.

Memory tip: Think "detect in 3 & 4, switch at 5" - NAT is discovered during the DH exchange phase (messages 3–4), and the port conversion kicks in starting at Message 5 (the encrypted authentication phase).

No community discussion yet for this question.