NAT traversal to a PIX not supporting NAT-T

[alan.morris]

Scenario:

Cisco VPN client through a PIX501 6.3(3) doing NAT to a PIX which does not support NAT-T {6.2(2)}. The VPN client is set to use tranparent tunneling.

The local pix has does not have fixup for ESP/IKE and has explicit access lists to allow ESP and ISAKMP traffic from designated hosts. This traffic going through a static nat.

Even so...I thought that the fact that NAT (albeit a static NAT) was supposed to prevent IPSEC from working. Can anyone explain to me why this works?

[gfullage]

IPSec and NAT (one-to-one address mapping) works fine, which I assume is what you're doing.

IPsec and PAT (one-to-many address mapping) is what doesn't work very well. This is because the IPSec ESP packets are not UDP or TCP packets, ESP sits right on top of IP and therefore doesn't have a TCP/UDP port number to use with the PAT'ing. A lot of PAT devices don't like this and drop the packets.

[alan.morris]

Glenn, Makes sense, thanks.