A method for performing an Authentication Header, AH, authentication on an Internet Protocol Security, IPSEC, packet having gone through Network Address Translation, NAT, traversal, comprising: a receiving end receiving an Internet Key Exchange, IKE, second-stage negotiation packet from a sending end; characterized in that the receiving end extracting an original Internet Protocol IP address and port number from a payload of the IKE second-stage negotiation packet as a first IP address and port number, and extracting an IP address and port number from a packet header of the IKE second-stage negotiation packet as a second IP address and port number; the receiving end establishing an NAT translation table according to the first IP address and port number and the second IP address and port number, comprising: the receiving end comparing the first IP address and port number with the second IP address and port number; and, if the first IP address and port number and the second IP address and port number are inconsistent, the receiving end establishing the NAT translation table used for translating the first IP address and port number and the second IP address and port number; and the receiving end performing the AH authentication on the received IPSEC packet having gone through the NAT traversal by using the NAT translation table, comprising: the receiving end receiving the IPSEC packet from the sending end, extracting an IP address and port number from a packet header of the IPSEC packet; the receiving end searching for the first IP address and port number corresponding to the extracted IP address and port number in the NAT translation table; and, if the first IP address and port number corresponding to the extracted IP address and port number are found, the receiving end replacing the IP address and port number in the packet header of the IPSEC packet having gone through the NAT traversal with the first IP address and port number, and recalculating a checksum for the AH authentication. a receiving end receiving an Internet Key Exchange, IKE, second-stage negotiation packet from a sending end; characterized in that the receiving end extracting an original Internet Protocol IP address and port number from a payload of the IKE second-stage negotiation packet as a first IP address and port number, and extracting an IP address and port number from a packet header of the IKE second-stage negotiation packet as a second IP address and port number; the receiving end establishing an NAT translation table according to the first IP address and port number and the second IP address and port number, comprising: the receiving end comparing the first IP address and port number with the second IP address and port number; and, if the first IP address and port number and the second IP address and port number are inconsistent, the receiving end establishing the NAT translation table used for translating the first IP address and port number and the second IP address and port number; and the receiving end performing the AH authentication on the received IPSEC packet having gone through the NAT traversal by using the NAT translation table, comprising: the receiving end receiving the IPSEC packet from the sending end, extracting an IP address and port number from a packet header of the IPSEC packet; the receiving end searching for the first IP address and port number corresponding to the extracted IP address and port number in the NAT translation table; and, if the first IP address and port number corresponding to the extracted IP address and port number are found, the receiving end replacing the IP address and port number in the packet header of the IPSEC packet having gone through the NAT traversal with the first IP address and port number, and recalculating a checksum for the AH authentication.