Network Address Translation (NAT) maps internal IP addresses and external ones. NAT can be implemented in a firewall or router, and is used to hide address information from the external network. But because it changes address information in the IP datagram, the NAT-ed packet will fail the integrity check of IPSec's AH protocol.

One way around this is for all network elements to use public addressing, thus obviating the need for NAT.

Another would be for the VPN to tunnel everything, which would hide non-public addresses from the network. But this will confuse any packet filters used in the network, perhaps at the router or firewall.