A site-to-site IPsec tunnel works until one peer is moved behind a router that performs port address translation. After the move, IKE negotiation completes but ESP packets are dropped at the PAT router and no protected traffic passes. Which mechanism resolves this, and why?
Select an answer to reveal the explanation.
Short Explanation
PAT keeps track of conversations by port numbers, and ESP doesn't have any — so your router has nothing to work with. NAT Traversal wraps ESP inside UDP 4500, giving PAT the ports it needs. The trap is AH; it signs the outer IP header, so any address change breaks it outright.
Full Explanation
Port address translation multiplexes many inside hosts behind one address by rewriting source ports and tracking them in a translation table. ESP is IP protocol 50 and carries no TCP or UDP header, so a PAT device has no port to rewrite or track and typically drops or mishandles the packets. NAT Traversal solves this: during IKE the peers detect that an address is being translated, move IKE from UDP 500 to UDP 4500, and encapsulate ESP inside UDP 4500 headers that the PAT router can translate like any other UDP flow. NAT keepalives then hold the mapping open during idle periods. Perfect forward secrecy performs a new Diffie-Hellman exchange for each Phase 2 rekey, which strengthens key independence but adds no port information. Authentication Header protects the outer IP header with its integrity check, so any address rewrite by NAT invalidates every packet, making it incompatible with translation. Dead peer detection checks whether the remote peer is alive; it does not give ESP a port and cannot create a protocol 50 mapping on a PAT router. Exam caveat: firewalls in the path must permit UDP 500 and UDP 4500 for NAT-T to work. Operational check: on the firewall's VPN status, confirm the security association shows NAT-T in use and that encapsulated packets are counted on UDP 4500.