crypto map Outside_map 1 set nat-t-disable

[mahesh18]

Hi everyone,

Need to know for site to site l2l ipsec tunnels below config

crypto map Outside_map0 7 set nat-t-disable

Will disable the NAT for traffic going from one side of tunnel  to another and vice versa?

Regards

Mahesh

[Marius Gunnerud · Accepted solution]

NAT-T does not disable NAT for traffic going from one side of the tunnel to another.  NAT-T is a function that allows a VPN tunnel to be formed when there is a NAT device in the path between the two devices which are trying to form a VPN tunnel.  for example.

ASA-------Router NAT device-----Internet----ASA

Say you are trying to establish a VPN between the two ASAs.  Because ESP, which is used to establish the VPN tunnel, does not use ports, the NAT device will have issues keeping track of the VPN traffic.  This will in turn result in the VPN traffic being dropped or not forwarded.

This is why we use NAT Traversal (NAT-T).  NAT traversal encapsulates the ESP inside of UDP on port 4500 by default.  Now the NAT device has a port it can destingquish this VPN traffic on and will be able to track it, and therefore the traffic will be forwarded and the VPN tunnel will be established.

--

Please remember to select a correct answer and rate helpful posts

[mahesh18]

Need to confirm with config

set nat-t-disable

 we are not using this feature hoping that in middle we have no  devices that do NAT right?

[Marius Gunnerud]

NAT -T is enabled by default. But you should know if there is a NAT device at the edge of your network. And the remote site should also know. Traffic will not pass over a NAT device on the Internet. 

[mahesh18]

but as per config i need to confirm that NAT-T is disabled right?

[Marius Gunnerud · Accepted solution]

No you don't.  Why would you need to disable it. Only disable it if you have a specific need to do so.

[mahesh18]

Many thanks Marius for answering all the way.

Regards

MAhesh