SSCP: Systems Security Certified Practitioner

By ISC · Question Mode

QuestionQ236

VerifiedNetwork and Communications Security

When using IPsec, both ESP and AH provide integrity services. However, when using AH, special attention is required if one of the peers uses NAT for address-translation services. Which item below would affect the use of AH and its Integrity Check Value (ICV) the most?

Explanation

AH computes its ICV over IP header fields that are immutable in transit, including source and destination addresses. NAT modifies those addresses, causing the receiver’s ICV verification to fail; this makes AH generally incompatible with address translation.

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!