What does NAT traversal (NAT-T) accomplish for VPNs?

• A. NAT-T forces ESP to be used without UDP
• B. NAT-T prevents IPsec from passing through NAT
• C. NAT-T allows IPv6 only VPNs
• D. NAT-T allows IPsec to pass through NAT by tunneling ESP in UDP

Answer: (D)

NAT traversal for VPNs tackles the problem that IPsec’s ESP traffic isn’t NAT-friendly, since ESP isn’t carried in UDP or TCP and NAT devices rewrite addresses and ports. NAT traversal wraps the ESP payload inside a UDP packet, typically using UDP port 4500, so NAT devices can translate the addresses and ports and keep the session alive. This UDP-encapsulation lets the IPsec tunnel pass through NAT devices and continue carrying encrypted data between the VPN endpoints.

That’s why the option describing tunneling ESP in UDP is the correct one. It isn’t about forcing ESP to avoid UDP, nor about preventing IPsec from passing through NAT, nor about IPv6-only VPNs.