N10-009 Question 88
Single answerA network administrator is deploying a site-to-site VPN between two branch offices using IPsec. The routers successfully establish Phase 1, but after that, traffic still does not pass through the tunnel. A packet capture shows that Internet Key Exchange (IKE) negotiation completes, but the encrypted payloads are being dropped by an upstream device because the original IP header must remain visible for routing and filtering. The administrator also wants to ensure the internal packet contents are encrypted in transit. Which IPsec protocol should be configured to best meet these requirements?
- A
Authentication Header (AH), because it provides integrity while leaving the original IP header visible
- B
Encapsulating Security Payload (ESP) in tunnel mode, because it encrypts the entire original packet and adds a new outer IP header
- C
Encapsulating Security Payload (ESP) in transport mode, because it encrypts only the payload and leaves the original IP header in place
- D
Generic Routing Encapsulation (GRE), because it provides encryption while preserving the original packet headers
Show answer and explanation
Correct answer: C
Explanation
The best answer is Encapsulating Security Payload (ESP) in transport mode. In IPsec, IKE is used to negotiate security associations and keys, but IKE itself does not carry user data. Once negotiation is complete, AH or ESP provides the actual packet protection. AH offers integrity and authentication but no encryption, so it cannot protect sensitive data contents. ESP provides confidentiality and can also provide integrity/authentication. In transport mode, ESP protects the payload while keeping the original IP header visible; in tunnel mode, ESP encapsulates the entire original IP packet and adds a new outer header. GRE is frequently confused with IPsec because both are used in VPN designs, but GRE only encapsulates traffic and does not encrypt it. This aligns with common vendor documentation and standards behavior described in RFC 4301 (Security Architecture for the Internet Protocol) and related IPsec RFCs, where transport mode is appropriate when the original IP header must remain available and only the payload needs protection.
- A. Incorrect.
Incorrect. AH provides authentication, integrity, and anti-replay protection, but it does not provide encryption. While AH does leave much of the original IP header visible, it would not satisfy the requirement to encrypt the internal packet contents. A common misconception is to choose AH when header visibility is needed, but AH is not used for confidentiality.
- B. Incorrect.
Incorrect. ESP in tunnel mode encrypts the original IP packet and encapsulates it inside a new IP packet with a new outer header. This is commonly used for site-to-site VPNs, but it does not leave the original IP header visible to upstream devices. If the requirement is that the original IP header remain visible for routing and filtering, tunnel mode does not fit that need.
- C. Correct.
Correct. ESP in transport mode encrypts the upper-layer payload while leaving the original IP header in place. That means intermediate devices can still see the original source and destination IP addresses for routing or filtering, while the packet contents remain encrypted. Since IKE has already completed Phase 1, the remaining issue is selecting the correct IPsec protection method for the traffic requirements.
- D. Incorrect.
Incorrect. GRE is a tunneling protocol, not an encryption protocol. It can encapsulate many Layer 3 protocols and is often paired with IPsec when both tunneling flexibility and encryption are needed. By itself, GRE does not provide confidentiality, integrity, or authentication.