Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Wherever I looked I only saw the description of NAT traversal for ESP protocol (for example:

It's looks that encapsulation of AH will work the same way (as for ESP) in transport mode, and in tunnel mode another new IP (+UDP) header should be added (so the total number of IP headers is 3).

Does it right? IS there another problem in NAT traversal for AH that I'm missing?

EDIT: The RFC that addresses this issue says that AH is not supported by UDP encapsulation whereas the draft of the same RFC purpose a solution for UDP encapsulation for AH protocol also.

share|improve this question
up vote 2 down vote accepted

AH includes the outer IP header in the HMAC calculation which is why NAT breaks it. My understanding was that NAT-T was never expanded to support AH because NAT breaks the outer IP header protection. "Because the protection of the outer IP addresses in IPsec AH is inherently incompatible with NAT, the IPsec AH was left out of the scope of this protocol specification."

share|improve this answer
The second link doesn't contribute much to understanding (it just saying what I alerady knew). I saw the RFC you linked before and still didn't understand - the AH protect the most outer IP header? event if there are 3 IP headers in the packet (as I described in the question)? – Bush Dec 5 '13 at 11:42
Also, see my edit.. – Bush Dec 5 '13 at 11:49
Since NAT breaks the end-to-end client to server model and AH is designed to protect the authenticity of the sender the RFP indicates that this was a design choice and not a technical limitation of NAT-T. So I think your understanding is correct that encapsulating the AH into a UDP packet would work same as ESP however it was never implemented by the designers of the protocol. – m3ta Dec 5 '13 at 14:09

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.