topic Re: Nat traversal in Network Security

Nat traversal

prashantrecon — Mon, 11 Mar 2019 21:22:28 GMT

What is the exact use of nat traversal .Can anyone explain with a scenario.

Nat traversal

varrao — Fri, 09 Sep 2011 06:25:12 GMT

Hi Prashant,

I woudl be able to explain you in detail, if you can let me know what are you trying to accomplish on the device and with whihc device are you working with.

Thanks,

Varun

Nat traversal

prashantrecon — Fri, 09 Sep 2011 06:52:05 GMT

Hi varun,

we are using asa 5520 in our environment.I am facing a problem ie able to connect to vpn from outside network to lan but not able to take a remote of lan pc from particular network connection (airtel isp).

But when i try this from other service provider like reliance i am able to take remote.

Nat traversal

varrao — Fri, 09 Sep 2011 07:33:46 GMT

Hi Prashant,

this is under the VPN Profile ur connecting to on the transport tab	12:30 PM
http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2264331	12:31 PM
by default on ASA NAT-T is enabled	12:32 PM
crypto isakmp nat-traversal is the command

If a remote client is coming from a direct public ip address.. like a publically hosted server, then it connects over the tunnel like the regular tunnel establishes.. over UDP port 500, but if a client comes from behind a NATd ip address.. like airtel ADSL modem.. where u have a priv ip address.. but ISP PATs/NATs it.., then it connects over UDP 500.. but is encapsulated by another header.. the NAt-T header.

and it communicates over UDP 4500... then on the headend device.. like ASA you need to have NAT-T enabled

when u have NAT-T enabled.. both NATd clients and clients with public ip will be able to connect

but if u dont then only clients wih public ip will b able to conenct

and also on the VPN client.. u need to have a check on
Enable Transparent Tunneling
and the radio button should be selected for IPSEC over UDP (NAT/PAT)

this is under the VPN Profile ur connecting to on the transport tab
http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2264331

by default on ASA NAT-T is enabled
crypto isakmp nat-traversal is the command

I hope this helps.

Thanks,

Varun

Re: Nat traversal

thanghadurai.shanmughem1 — Fri, 14 Jun 2019 05:35:33 GMT

Hi Varrao,

In this case, does NAT-T will cause any issues while establishing phase-1 tunnel between the end-clients ?

In my scenario, I could see the Tunnel got established but I do not see any Tx and Rx bytes under the VPN Session.

Thanks in Advance..

Re: Nat traversal

thanghadurai.shanmughem1 — Fri, 14 Jun 2019 06:12:37 GMT

Hi Varrao,

In this case, does NAT-T will cause any issues while establishing phase-1 tunnel between the end-clients ?

In my scenario, I could see the Tunnel got established but I do not see any Tx and Rx bytes under the VPN Session.

Thanks in Advance..