Enabling IPSec over NATT

Last Updated on Wed, 28 Jun 2023 | Security Appliance

NAT-T lets IPSec peers establish a connection through a NAT device. It does this by encapsulating IPSec traffic in UDP datagrams, using port 4500, thereby providing NAT devices with port information. NAT-T auto-detects any NAT devices, and only encapsulates IPSec traffic when necessary. This feature is disabled by default.

With the exception of the home zone on the Cisco ASA 5505, the security appliance can simultaneously support standard IPSec, IPSec over TCP, NAT-T, and IPSec over UDP, depending on the client with which it is exchanging data. When both NAT-T and IPSec over UDP are enabled, NAT-T takes precedence. IPSec over TCP, if enabled, takes precedence over all other connection methods.

When you enable NAT-T, the security appliance automatically opens port 4500 on all IPSec enabled interfaces.

The security appliance supports multiple IPSec peers behind a single NAT/PAT device operating in one of the following networks, but not both:

• LAN-to-LAN

• Remote access

In a mixed environment, the remote access tunnels fail the negotiation because all peers appear to be coming from the same public IP address, that of the NAT device. Also, remote access tunnels fail in a mixed environment because they often use the same name as the LAN-to-LAN tunnel group (that is, the IP address of the NAT device). This match can cause negotiation failures among multiple peers in a mixed LAN-to-LAN and remote access network of peers behind the NAT device.

Using NAT-T

To use NAT-T, you must perform the following tasks:

Step 1

Enter the following command to enable IPSec over NAT-T globally on the security appliance. _Cisco Security Appliance Command Line Configuration Guide ■

crypto isakmp nat-traversal natkeepalive

natkeepalive is in the range 10 to 3600 seconds. The default is 20 seconds.

For example, enter the following command to enable NAT-T and set the keepalive to one hour.

hostname(config)# crypto isakmp nat-traversal 3600

Step 2 Select the "before-fragmentation" option for the IPSec fragmentation policy.

This option lets traffic travel across NAT devices that do not support IP fragmentation. It does not impede the operation of NAT devices that do support IP fragmentation.

Continue reading here: Enabling IPSec over TCP

Was this article helpful?

0 -1

Recommended Books

  • Cisco Security Appliance Command Line Configuration Guide
  • Network Security Through Data Analysis: From Data to Action
  • Network Security: Private Communication in a Public World
  • Network Security Assessment: Know Your Network
  • Network Security: A Beginner's Guide

Related Posts

Readers' Questions

  • Zewdi
    What is nat traversal?
    8 months ago
    • NAT Traversal, also known as NAT traversal, is the process of establishing and maintaining Internet protocol connections across a network address translator (NAT). NAT traversal techniques are typically used in applications that require direct connection between two hosts without NAT. This is especially common in peer-to-peer (P2P) applications, such as file sharing, instant messaging, and Voice over IP (VoIP). NAT Traversal typically involves establishing a virtual connection, such as port forwarding, between two hosts on different networks.