Enforce Ipsec over UDP500 only while still having nat server

[sudsark]

Hi There,

We have a setup where we have Ipsec established as given below

Cisco Router << -- >> NAT instance (ec2 aws hosted) <<-->> ASAv.  Now since we are having nat instance and doing translation between hence Ipsec tunnel established using UDP500 and UDP4500 ( for Nat-t) . I have disabled nat-t from asav side but still seeing UDP4500 in action. We have a hard requirement that we have to have Ipsec established only over UDP500 ( since 20K hospital networks having direct conenction and UDP500 only allowed, now with migration to new infra is a challenge due to this ) . 

My question is , is there any way we can enforce the communication to happen only over UDP500 ? Any help is greatly appreciated.

Please let me know if any question. 

Thank You!

[M02@rt37]

Hello @sudsark 

You can not force pure udp_500 IPsec through a NAT device, even if NAT-T is disabled, because the ike nego detect the NAT and re-encapsulate automaticaly.

The only way to use UDP_500 exclusively is to ensure no NAT is present between the peers...