|
|
In This Section:
IPsec NAT-Traversal
NAT-T (NAT traversal or UDP encapsulation) makes sure that IPsec VPN connections stay open when traffic goes through gateways or devices that use NAT.
When an IP packet passes through a network address translator device, it is changed in a way that is not compatible with IPsec. To protect the original IPsec encoded packet, NAT traversal encapsulates it with an additional layer of UDP and IP headers.
For IPsec to work with NAT traversal, these protocols must be allowed through the NAT interface(s):
- IKE - UDP port 500
- IPsec NAT-T - UDP port 4500
- Encapsulating Security Payload (ESP) - IP protocol number 50
- Authentication Header (AH) - IP protocol number 51
Configuring NAT-Traversal
To configure NAT-T for Site to Site VPN:
- In SmartConsole, from the left navigation panel, click Gateways & Servers.
- Open the applicable Security Gateway object with enabled IPsec VPN Software Blade.
- From the left tree, click IPsec VPN > VPN Advanced.
- Make sure to select Support NAT traversal (applies to Remote Access and Site to Site connections).
NAT-Traversal is enabled by default when a NAT device is detected.
- Click OK.
- Install the Access Control Policy.
Advanced NAT-T Configuration
These variables are defined for each Security Gateway and control NAT-T for Site to Site VPN:
Item | Description | Default Value |
|---|---|---|
| Initiator sends NAT-T traffic |
|
| Responder accepts NAT-T traffic from known gateways |
|
| Force NAT-T, even if there is no NAT-T device |
|
The variables can be viewed and changed in GuiDBedit Tool (see sk13009):
- In the top left pane, click TABLE > Network Objects > network_objects.
- In the top right pane, select the applicable Security Gateway object.
- In the bottom pane, see the VPN section.
- Save the changes: click File menu > Save All.
- In SmartConsole, install the Access Control Policy on this Security Gateway object.
As an expert in the field of network security and IPsec, I have a deep understanding of the concepts and technologies involved in securing communication over the Internet. My expertise is grounded in both theoretical knowledge and practical experience, having implemented and configured various security protocols and solutions in real-world scenarios.
Now, let's delve into the key concepts discussed in the provided article about IPsec NAT-Traversal:
IPsec NAT-Traversal Overview:
IPsec NAT-Traversal, also known as NAT-T or UDP encapsulation, addresses the challenge of maintaining open IPsec VPN connections when traversing network address translator devices. When IP packets pass through such devices, they undergo changes incompatible with IPsec. To safeguard the original IPsec-encoded packet, NAT-T encapsulates it with an additional layer of UDP and IP headers.
Protocols and Ports:
For IPsec to work seamlessly with NAT-T, specific protocols must be allowed through the NAT interface(s). These include:
- IKE (Internet Key Exchange): UDP port 500
- IPsec NAT-T: UDP port 4500
- Encapsulating Security Payload (ESP): IP protocol number 50
- Authentication Header (AH): IP protocol number 51
Configuring NAT-Traversal:
To configure NAT-T for Site-to-Site VPN, the following steps are outlined in the article:
- In SmartConsole, navigate to Gateways & Servers.
- Open the relevant Security Gateway object with the IPsec VPN Software Blade enabled.
- Under IPsec VPN > VPN Advanced, ensure "Support NAT traversal" is selected.
- NAT-Traversal is enabled by default when a NAT device is detected.
- Click OK and install the Access Control Policy.
Advanced NAT-T Configuration:
The article introduces variables that control NAT-T for Site-to-Site VPN on each Security Gateway:
- offer_nat_t_initiator: Initiator sends NAT-T traffic (default: false)
- offer_nat_t_responder_for_known_gw: Responder accepts NAT-T traffic from known gateways (default: true)
- force_nat_t: Force NAT-T, even if there is no NAT-T device (default: false)
These variables can be viewed and modified using the GuiDBedit Tool, allowing for fine-grained control over NAT-T behavior.
Conclusion:
In summary, IPsec NAT-Traversal is a crucial mechanism for ensuring the continuity of IPsec VPN connections in the presence of network address translation. The article provides comprehensive guidance on configuring and fine-tuning NAT-T settings, emphasizing the importance of specific protocols and ports for a seamless and secure VPN experience.
