Nat traversal

[prashantrecon]

What is the exact use of nat traversal .Can anyone explain with a scenario.

[varrao]

Hi Prashant,

I woudl be able to explain you in detail, if you can let me know what are you trying to accomplish on the device and with whihc device are you working with.

Thanks,

Varun

[prashantrecon]

Hi varun,

we are using asa 5520 in our environment.I  am  facing a problem ie  able to connect to vpn from outside network to lan but not able to take a remote of lan pc from particular network connection (airtel isp).

But when i try this from other service provider like reliance i am able to take remote.

[varrao · Accepted solution]

Hi Prashant,

this is under the VPN Profile ur  connecting to on the transport tab	12:30 PM
http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2264331	12:31 PM
by default on ASA NAT-T is  enabled	12:32 PM
crypto isakmp  nat-traversal is the command

If a remote client is coming from a direct public ip address.. like a publically hosted server, then it connects over the tunnel like the regular tunnel establishes.. over UDP port 500, but if a client comes from behind a NATd ip address.. like airtel ADSL modem.. where u have a priv ip address.. but ISP PATs/NATs it.., then it connects over UDP 500.. but is encapsulated by another header.. the NAt-T header.

and it communicates over UDP 4500...  then on the headend device.. like ASA you need to have NAT-T enabled 

when u have NAT-T enabled.. both NATd clients and clients with public ip will be able to connect

but if u dont then only clients wih public ip will b able to conenct

and also on the VPN client.. u need to have a check on 
Enable Transparent Tunneling 
and the radio button should be selected for IPSEC over UDP (NAT/PAT)

this is under the VPN Profile ur connecting to on the transport tab
http://www.cisco.com/en/US/docs/security/asa/asa83/command/reference/c5.html#wp2264331

by default on ASA NAT-T is enabled 
crypto isakmp nat-traversal is the command

I hope this helps.

Thanks,

Varun

[thanghadurai.shanmughem1]

Hi Varrao,

In this case, does NAT-T will cause any issues while establishing phase-1 tunnel between the end-clients ? 

In my scenario, I could see the Tunnel got established but I do not see any Tx and Rx bytes under the VPN Session. 

Thanks in Advance..

[thanghadurai.shanmughem1]

Hi Varrao,

In this case, does NAT-T will cause any issues while establishing phase-1 tunnel between the end-clients ? 

In my scenario, I could see the Tunnel got established but I do not see any Tx and Rx bytes under the VPN Session. 

Thanks in Advance..