IPsec ESP Protocol with ACK and Sequence Numbers

Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN

Answer Correct answer: C — Encapsulating Security Payload (ESP) provides the necessary sequence numbering and integrity checks for reliable IPsec communication.

An engineer is configuring IPsec VPN and needs an authentication protocol that is reliable and supports ACK and sequence. Which protocol accomplishes this goal?

AES-256
IKEv1
ESP Correct Answer
AES-192

Community Insight

The core concept is distinguishing between the protocols that provide authentication/key exchange (IKE) versus those that provide payload security (ESP). The common trap is confusing IKEv2's session management ACKs with ESP's packet-level sequence numbers.

This question tests knowledge of IPsec protocol components, specifically Encapsulating Security Payload (ESP), which provides both encryption and reliability features like sequence numbers.

Many candidates incorrectly select IKEv1 (B) because they associate 'authentication' with IKE. However, IKEv1 does not support ACK mechanisms (unlike IKEv2), and neither IKE version handles the sequence/ACK requirements for the data payload itself.

Community Discussion (14 comments)

XBfoundX 👍 1 Selected: C

AES256 and 192, are cipher algorithms, Ikev1 does not support ack, so the only one that can be right is ESP, so the correct answer is C.

CyberGhost666 👍 2 Selected: C

I’ll go with ESP

ITVI 👍 1 Selected: B

Ack and Sequences is the keyword here so B for me.

Silexis 👍 1

IKEv1 DOES NOT HAVE an ACK embeded mechanism like IKEv2. For example a SA_DELETE in IKEv1 is sent without confirmation because IKEv1 is using UDP which is a best effort protocol and while IKEv2 is using the same UDP, it has embedded ACK to correct the minuses of IKEv1. From all these - IKEv1 it is a wrong answer, making ESP the only option left. The question is crap, indeed (probably was talking about SPI inside ESP)

Bubu3k 👍 1 Selected: C

Ikev1 does not have acks, ikev2 does: https://learningnetwork.cisco.com/s/article/comparison-between-ikev1-and-ikev2

Rododendron2 👍 2 Selected: C

ESP - it has ACK & sequence numbers, not IKEv1 But call it authentication protocol is misleading. Shame on you, Cisco

Rododendron2 👍 1 Selected: C

Has to be IKEv2 (ack is there) and ESP - so C

Tthurston1 👍 1 Selected: B

ESP provides confidentiality, authentication, and integrity to IP Packets. It does NOT include mechanisms for acknowledging or sequencing messages - which is a requirement for this question. IKEv1 SUPPORTS acknowledgements and sequencing to ensure reliable delivery of messages during the negotiation process.

Rododendron2 👍 1

Neither IKEv1 or ESP has ACK messages. IKEv1 has 6 messages, to negotiate tunnel, that's all. ESP sure does have sequence numbers.

gorequill 👍 2 Selected: C

https://www.rfc-editor.org/rfc/rfc7402.html

Ko13 👍 2 Selected: B

Ikev1 does authentication and a has a handshake process https://www.cisco.com/c/es_mx/support/docs/security-vpn/ipsec-negotiation-ike-protocols/217432-understand-ipsec-ikev1-protocol.html

Modulator 👍 1

A,C and D are Encryption protocols... so B

spykasgr 👍 1

it is B ikev1

NoUserName1234 👍 5

Answer 'C' : https://www.hypr.com/security-encyclopedia/encapsulating-security-payload-esp

Comments & Corrections

No comments yet — spotted an error or have a note? Share it below.

Expert Analysis

Why the Answer Is Correct

Encapsulating Security Payload (ESP) is the correct answer because it operates at the IPsec protocol layer to protect the actual data traffic. ESP includes a Sequence Number field in its header to prevent replay attacks, which serves the purpose of tracking packet order and ensuring reliability. While the question asks for an 'authentication protocol,' in the context of Cisco exams, this often refers to the component providing integrity and anti-replay services, which ESP does via its ICV (Integrity Check Value) and sequence numbers.

Why the Other Options Are Wrong

AES-256 (A) and AES-192 (D) are symmetric encryption algorithms used within IPsec, but they are not protocols themselves and do not handle sequencing or acknowledgment logic. IKEv1 (B) is a key exchange protocol; while it authenticates peers, it lacks the embedded ACK mechanism found in IKEv2 and does not manage packet sequences for the data tunnel.

Community Comment Notes

Community consensus strongly favors ESP (C). Users point out that AES options are just ciphers, eliminating them immediately. Comments highlight that IKEv1 does not have ACKs, whereas IKEv2 does, making IKEv1 incorrect for any protocol relying on acknowledgments. One user notes the question phrasing is slightly misleading by calling ESP an 'authentication protocol,' but correctly identifies it as the only option with sequence capabilities.

Official Reference

https://www.rfc-editor.org/rfc/rfc4303.html

Exam Strategy

When asked about 'sequence numbers' or 'replay protection' in IPsec, think ESP. When asked about 'key exchange' or 'peer authentication', think IKE. Don't let the word 'authentication' distract you from the functional requirement of sequence handling, which is specific to the payload protocol.

Frequently Asked Questions

Does ESP provide authentication?

Yes, ESP can provide data origin authentication and integrity through its Integrity Check Value (ICV), in addition to confidentiality.

Why is IKEv1 wrong for ACK requirements?

IKEv1 uses UDP without built-in acknowledgments. IKEv2 added explicit ACK messages to improve reliability over unreliable transports.

More 350-701 FAQ →

Related Analysis

← Back to 350-701 Study Guide