NSE4 · Question #330
What are the purposes of NAT traversal in IPsec? (Choose two.)
The correct answer is A. To detect intermediary NAT devices in the tunnel path. B. To encapsulate ESP packets in UDP packets using port 4500. NAT traversal (NAT-T) in IPsec is used to detect intermediary NAT devices in the tunnel path and to encapsulate ESP packets in UDP packets using port 4500 to pass through NAT.
Question
What are the purposes of NAT traversal in IPsec? (Choose two.)
Options
- ATo detect intermediary NAT devices in the tunnel path.
- BTo encapsulate ESP packets in UDP packets using port 4500.
- CTo force a new DH exchange with each phase 2 re-key
- DTo dynamically change phase 1 negotiation mode to Aggressive.
How the community answered
(31 responses)- A94% (29)
- C3% (1)
- D3% (1)
Why each option
NAT traversal (NAT-T) in IPsec is used to detect intermediary NAT devices in the tunnel path and to encapsulate ESP packets in UDP packets using port 4500 to pass through NAT.
NAT-T begins with an exchange of vendor IDs during IKE Phase 1 to detect if a NAT device exists between the two IPsec peers, indicating that NAT-T is required for the tunnel to function.
When NAT is detected, IPsec NAT-T encapsulates the Encapsulating Security Payload (ESP) packets, which do not inherently support NAT, into UDP packets using port 4500. This encapsulation allows the NAT device to translate the UDP headers, enabling the IPsec tunnel to be established and maintained across NAT.
NAT-T does not force a new Diffie-Hellman (DH) exchange with each Phase 2 re-key; DH exchanges are typically for Phase 1 key establishment.
NAT-T does not dynamically change the Phase 1 negotiation mode; it typically operates with Main Mode and adjusts how packets are encapsulated for NAT compatibility.
Concept tested: IPsec NAT traversal (NAT-T) mechanism
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/339241/vpn-across-a-nat-device
Topics
Community Discussion
No community discussion yet for this question.