CAP7001 · Unit 6: Application layer
SNMP, IPSec, VPN and firewalls
10 practice questions · in the ETE syllabus
Key points
- SNMP agents use UDP 161 and send traps to the manager on 162
- AH authenticates only, ESP also encrypts
- Tunnel mode wraps the whole inner packet, transport mode keeps the IP header
- Firewalls apply the first matching rule
- Stateful firewalls track connections and allow replies back
SNMP manages network devices. A manager talks to agents running on devices, and each agent exposes values in a MIB. Agents listen on UDP port 161. The manager uses GetRequest to read, GetNextRequest to walk the MIB and SetRequest to change a value. An agent sends a Trap on its own to the manager (port 162) when an event such as a link failure occurs.
IPSec secures traffic at the network layer. AH gives integrity and authentication only. ESP adds encryption. In transport mode the original IP header stays and only the payload is protected, which suits host-to-host links. In tunnel mode the whole original packet is wrapped in a new IP packet, which suits gateway-to-gateway links.
A VPN builds a private channel across the Internet; a site-to-site VPN typically uses ESP in tunnel mode between two gateways. AH breaks when a NAT device is on the path, because it covers the IP addresses that NAT rewrites.
Firewalls filter traffic. A packet filter checks addresses, protocol and ports against a rule list and applies the first matching rule. A stateful firewall also records connections in a state table, so replies to outbound sessions are allowed back automatically.
Worked example: rules 1 allow TCP to 10.0.0.0/24, 2 deny TCP to 10.0.0.5 port 23. A Telnet packet to 10.0.0.5 is allowed by rule 1, so rule 2 is shadowed.
Exam trap: firewalls do not choose the most specific rule, only the first match, so rule order matters.
Try two questions
Which statement about IPSec AH and ESP is correct?
- AH encrypts the payload, whereas ESP only authenticates
- ESP can encrypt the payload, whereas AH only authenticates
- Both encrypt the payload but differ in port numbers
- AH works only in tunnel mode and ESP only in transport mode
Show the answer
B. AH gives integrity and authentication, while ESP adds confidentiality as well.
Why not A: That reverses the two protocols.
Why not C: AH provides no encryption and neither uses port numbers.
Why not D: Both protocols can run in either mode.
What is the main difference between IPSec transport mode and tunnel mode?
- Transport mode encrypts the IP header, and tunnel mode does not
- Tunnel mode secures just the TCP header of each packet
- Tunnel mode wraps the whole original IP packet inside a new IP packet
- Transport mode requires a firewall at both ends
Show the answer
C. Tunnel mode hides the original addresses, which suits gateway-to-gateway VPNs.
Why not A: Transport mode protects the payload and leaves the original IP header in the clear.
Why not B: Tunnel mode protects the entire inner packet.
Why not D: Firewalls are not required by either mode.