Introduction - If you have any usage issues, please Google them yourself
IPSec AH and NAT
AH integrity check covers addresses in the IP header. The integrity check fails at the destination due to NAT /reverse-NAT modifying these addresses. This applies to both AH transport and tunnel modes. Note that this does not apply to ESP