Huawei Certified ICT Professional - Constructing Infrastructure of Security Network H12-721 Question # 30 Topic 4 Discussion
H12-721 Exam Topic 4 Question 30 Discussion:
Question #: 30
Topic #: 4
Two USG firewalls failed to establish an IPSec VPN tunnel through the NAT traversal mode. Run the display ike sa command to view the session without any UDP 500 session. What are the possible reasons?
Note: IKE messages use UDP port 500. When NAT traversal is not enabled, AH and ESP are directly carried over IP. The protocol numbers are 51 and 50 respectively. In the case of NAT traversal, the first phase--messages and destinations of the IKE exchange process use UDP 4500 for both the source port and the destination port. All IKE messages exchanged with the initiator use 4500 ports. If the initiator is inside the NAT, Then NAT changes the source port of the initiator to another port to communicate with other devices. After the first phase of IKE is completed, both parties to the communication know the existence of NAT, and then negotiate whether to use NAT traversal in the SA load of the second phase of IKE, by adding two new encapsulation modes: UDP-tunnel and transmission mode. . An ESP header is encapsulated directly after the UDP header. The source port number and destination port number in the UDP packet header are the same as the IKE protocol. Therefore, it is necessary to check whether the intermediate device blocks protocol numbers 51 and 50, and the packets of UDP 500 and UDP 4500 ports pass. Analysis - because display ike sees no messages, that is, the first phase of IKE is not completed. The correct answer should be AC
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit