Wherever I looked I only saw the description of NAT traversal for ESP protocol (for example: http://pic.dhe.ibm.com/infocenter/iseries/v6r1m0/index.jsp?topic=/rzaja/rzajaudpencap.htm)

It's looks that encapsulation of AH will work the same way (as for ESP) in transport mode, and in tunnel mode another new IP (+UDP) header should be added (so the total number of IP headers is 3).

Does it right? IS there another problem in NAT traversal for AH that I'm missing?

EDIT: The RFC that addresses this issue says that AH is not supported by UDP encapsulation whereas the draft of the same RFC purpose a solution for UDP encapsulation for AH protocol also.

1 Answer 1


AH includes the outer IP header in the HMAC calculation which is why NAT breaks it. My understanding was that NAT-T was never expanded to support AH because NAT breaks the outer IP header protection.

http://www.ietf.org/rfc/rfc3948.txt "Because the protection of the outer IP addresses in IPsec AH is inherently incompatible with NAT, the IPsec AH was left out of the scope of this protocol specification."

  • The second link doesn't contribute much to understanding (it just saying what I alerady knew). I saw the RFC you linked before and still didn't understand - the AH protect the most outer IP header? event if there are 3 IP headers in the packet (as I described in the question)?
    – Bush
    Dec 5, 2013 at 11:42
  • Also, see my edit..
    – Bush
    Dec 5, 2013 at 11:49
  • 1
    Since NAT breaks the end-to-end client to server model and AH is designed to protect the authenticity of the sender the RFP indicates that this was a design choice and not a technical limitation of NAT-T. So I think your understanding is correct that encapsulating the AH into a UDP packet would work same as ESP however it was never implemented by the designers of the protocol.
    – m3ta
    Dec 5, 2013 at 14:09

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .