FTD 2130 NAT-T Disable problem

[orkhan.rustamli.96]

Hi all,

Have a problem with NAT-T. I have FTD 2130 device managed by FMC which is terminating all my VPN connections. FTD does not have PUBLIC IP attached to internet, instead I have internet router that is doing 1-to-1 static NAT without any port for VPN termination interface. In this case actually i do not need nat-t but because all my customers` devices support nat-t, it was working well without any problem until today. I must connect new third-party through internet. They use Kerio Control in their side which i think no accepting UDP 4500 connections for VPN. Now I want to disable NAT-T for solving problem but i cannot. There is no option in FMC. I tried FlexConfig but FMC does not accept my configuration as telling "Unsupported CLI". Now I am not sure whether command, really, is not supported or i am doing something wrong. Any help is appreciated. 

Thanks in advance!! 

[Ilkin]

Orkhan, salam.

Disabling 'Keepalive Messages Traversal' in Advanced settings of a VPN topology under Tunnel setting should fix the issue.

[orkhan.rustamli.96]

Salam Ilkin,

I forgot to mention that I had already done that with no result. I have found a recent bug CSCvh87734 telling that workoround is using FlexConfig but Flex does not support VPN commands. 

[orkhan.rustamli.96 · Accepted solution]

Although FlexConfig does not accept crypto ipsec commands i could disable NAT-T by creating FlexConfig which contained following command "no crypto isakmp nat-t". Previously I tried to delete it in ipsec phase by command "crypto map XXX set nat-t-disable" which was not accapted.