Have several PIX 515's. I can cfg a l2l VPN between 2 of them (or ns5gt's) w/o a problem. To test NAT-T I have 3 PIX's in-line. PIX1-PIX2-PIX3. Traffic is generated from a PC hung off PIX1 to a PC hanging off PIX3. All is fine but NAT-T doesn't seem to work. I've used 'debug cry is 254' and Wireshark and cannot find why PIX3 complains; "can't find a valid tunnel-group, aborting". It appears that PIX3 sees this tunnel as coming from PIX2's NAT address, not PIX1. And then it doesn't find a tunnel group as the TG is defined as PIX1, not PIX2.
Also, where/if is the output to the debug documented, outside cisco that is ?
What is NAT-D ?
