View all questions & answers for the H12-725_V4.0 exam
When an IPsec VPN is established in aggressive mode, AH+ESP can be used to encapsulate packets in NAT traversal scenarios.
TRUE
FALSE
Comprehensive and Detailed Explanation:
Aggressive modeis a faster IKE Phase 1 negotiation method butdoes not support NAT traversal (NAT-T) with AH.
NAT-T only works with ESP, because:
AH includes the original IP header in its integrity check, which breaks when NAT modifies the IP address.
ESP works with NAT-Tsince it does not include the original IP header in its integrity check.
Why is this statement false?
AH does not support NAT-T, soAH+ESP cannot be used in NAT traversal scenarios.
HCIP-Security References:
Huawei HCIP-Security Guide → IPsec VPN NAT Traversal
Submit