IPsec ESP Protocol with ACK and Sequence Numbers

350-701 By islever Editorial Last updated

Describe site-to-site and remote access VPN deployment types such as virtual tunnel interfaces, standards-based IPsec, SSL VPN, DMVPN, FlexVPN, and GETVPN

Short answer

C Encapsulating Security Payload (ESP) provides the necessary sequence numbering and integrity checks for reliable IPsec communication.

Question

An engineer is configuring IPsec VPN and needs an authentication protocol that is reliable and supports ACK and sequence. Which protocol accomplishes this
goal?
  1. AES-256
  2. IKEv1
  3. ESP Correct Answer
  4. AES-192

Key Takeaways

The core concept is distinguishing between the protocols that provide authentication/key exchange (IKE) versus those that provide payload security (ESP). The common trap is confusing IKEv2's session management ACKs with ESP's packet-level sequence numbers.

This question tests knowledge of IPsec protocol components, specifically Encapsulating Security Payload (ESP), which provides both encryption and reliability features like sequence numbers.

Common mistake: Many candidates incorrectly select IKEv1 (B) because they associate 'authentication' with IKE. However, IKEv1 does not support ACK mechanisms (unlike IKEv2), and neither IKE version handles the sequence/ACK requirements for the data payload itself.

Expert Analysis

Why the Answer Is Correct

Encapsulating Security Payload (ESP) is the correct answer because it operates at the IPsec protocol layer to protect the actual data traffic. ESP includes a Sequence Number field in its header to prevent replay attacks, which serves the purpose of tracking packet order and ensuring reliability. While the question asks for an 'authentication protocol,' in the context of Cisco exams, this often refers to the component providing integrity and anti-replay services, which ESP does via its ICV (Integrity Check Value) and sequence numbers.

Why the Other Options Are Wrong

AES-256 (A) and AES-192 (D) are symmetric encryption algorithms used within IPsec, but they are not protocols themselves and do not handle sequencing or acknowledgment logic. IKEv1 (B) is a key exchange protocol; while it authenticates peers, it lacks the embedded ACK mechanism found in IKEv2 and does not manage packet sequences for the data tunnel.

Community Comment Notes

Community consensus strongly favors ESP (C). Users point out that AES options are just ciphers, eliminating them immediately. Comments highlight that IKEv1 does not have ACKs, whereas IKEv2 does, making IKEv1 incorrect for any protocol relying on acknowledgments. One user notes the question phrasing is slightly misleading by calling ESP an 'authentication protocol,' but correctly identifies it as the only option with sequence capabilities.

Official Reference

https://www.rfc-editor.org/rfc/rfc4303.html

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about 'sequence numbers' or 'replay protection' in IPsec, think ESP. When asked about 'key exchange' or 'peer authentication', think IKE. Don't let the word 'authentication' distract you from the functional requirement of sequence handling, which is specific to the payload protocol.

Frequently Asked Questions

Does ESP provide authentication?

Yes, ESP can provide data origin authentication and integrity through its Integrity Check Value (ICV), in addition to confidentiality.

Why is IKEv1 wrong for ACK requirements?

IKEv1 uses UDP without built-in acknowledgments. IKEv2 added explicit ACK messages to improve reliability over unreliable transports.

More 350-701 FAQ →

Discussion 14 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 14

  1. NoUserName1234 👍 5
    Answer 'C' : https://www.hypr.com/security-encyclopedia/encapsulating-security-payload-esp
  2. Ko13 👍 2 Answered B
    Ikev1 does authentication and a has a handshake process https://www.cisco.com/c/es_mx/support/docs/security-vpn/ipsec-negotiation-ike-protocols/217432-understand-ipsec-ikev1-protocol.html
  3. Rododendron2 👍 2 Answered C
    ESP - it has ACK & sequence numbers, not IKEv1 But call it authentication protocol is misleading. Shame on you, Cisco
  4. gorequill 👍 2 Answered C
    https://www.rfc-editor.org/rfc/rfc7402.html
  5. CyberGhost666 👍 2 Answered C
    I’ll go with ESP
Show 9 more comments
  1. Silexis 👍 1
    IKEv1 DOES NOT HAVE an ACK embeded mechanism like IKEv2. For example a SA_DELETE in IKEv1 is sent without confirmation because IKEv1 is using UDP which is a best effort protocol and while IKEv2 is using the same UDP, it has embedded ACK to correct the minuses of IKEv1. From all these - IKEv1 it is a wrong answer, making ESP the only option left. The question is crap, indeed (probably was talking about SPI inside ESP)
  2. Tthurston1 👍 1 Answered B
    ESP provides confidentiality, authentication, and integrity to IP Packets. It does NOT include mechanisms for acknowledging or sequencing messages - which is a requirement for this question. IKEv1 SUPPORTS acknowledgements and sequencing to ensure reliable delivery of messages during the negotiation process.
  3. XBfoundX 👍 1 Answered C
    AES256 and 192, are cipher algorithms, Ikev1 does not support ack, so the only one that can be right is ESP, so the correct answer is C.
  4. Rododendron2 👍 1
    Neither IKEv1 or ESP has ACK messages. IKEv1 has 6 messages, to negotiate tunnel, that's all. ESP sure does have sequence numbers.
  5. Bubu3k 👍 1 Answered C
    Ikev1 does not have acks, ikev2 does: https://learningnetwork.cisco.com/s/article/comparison-between-ikev1-and-ikev2
  6. ITVI 👍 1 Answered B
    Ack and Sequences is the keyword here so B for me.
  7. Rododendron2 👍 1 Answered C
    Has to be IKEv2 (ack is there) and ESP - so C
  8. Modulator 👍 1
    A,C and D are Encryption protocols... so B
  9. spykasgr 👍 1
    it is B ikev1

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

What Is a Feature of an Endpoint Detection and Response Solution?

S-grade

Which Two Methods Belong in an AAA Authentication Method List?

S-grade

Preventing Unauthorized DHCP Servers on Cisco Switches

S-grade

What Is Considered a Cloud Data Breach in Cisco 350-701?

S-grade

← Back to 350-701 Study Guide