Which of the following statements about the NSG support for NAT-T is TRUE?

In the Nokia Network Services Gateway (NSG), NAT Traversal (NAT-T) for IPsec is a feature that is configured on a per-port basis. This means it is an attribute of a specific network port, typically an uplink port used for WAN connectivity. Administrators can enable or disable NAT-T on individual ports, allowing for granular control over which connections will use the NAT-T mechanism to establish IPsec tunnels through Network Address Translation (NAT) devices. This port-level configuration is fundamental to how the NSG manages its WAN interfaces and VPN connectivity.

B. NAT-T NPM probes are not disabled by default. When NAT-T is enabled on a port, the NSG automatically uses these probes to discover the presence and type of NAT device.

C. The NSG's NAT-T implementation does not support establishing a direct IPsec tunnel between two endpoints that are both located behind Symmetric NAT devices. This is a common limitation in NAT-T.

D. The NSG's NAT discovery process does not specifically require the use of two NPM probes for address-restricted mapping. The mechanism is more general for identifying various NAT types.

1. Nokia Nuage Networks VNS User Guide, Release 20.10.R1: In the chapter "Configuring the NSG instance", the section "Configuring NSG uplink ports" details the configuration parameters for a port. The nat-traversal option is shown as a configurable parameter within the port context, confirming it is a port-level attribute. (Reference: Chapter 4: Configuring the NSG instance > Configuring NSG uplink ports).

2. Nokia Nuage Networks VNS User Guide, Release 20.10.R1: The chapter "Security Services" under the section "NAT Traversal for IPsec" describes the operational flow. It states, "When NAT-T is enabled on a port, the NSG sends NPM probes from its uplink to the VSC...". This confirms that probes are used when the feature is enabled, contradicting option B.

3. Nokia Nuage Networks VNS User Guide, Release 20.10.R1: The "NAT Traversal for IPsec" section also contains a subsection titled "Unsupported NAT Scenarios". This subsection explicitly lists "Symmetric NAT to Symmetric NAT" as an unsupported scenario for direct NSG-to-NSG IPsec tunnels, invalidating option C.