NAT-Travesal

[shivaram840]

I want to understand what is the use of NAT-T ?

i have gone through many documents but still confusing me.

we have a site to site vpns between two ASA firewalls , so i have disabled NAT-T on asa firewall but still both sites are communication each other ?

i believe ipsec will not work behind the nat device until use the NAT-T then how it is pining even disabled the NAT-T ???

Thanks,

Shiva

[Masoud Pourshabanian]

Hello Shiva,

IPsec encrypts both data and TCP header. It also encrypts IP header if tunnel mode is used. If you check the packets with Wireshark, you see only layer 3 and ESP or AH as layer 4 so it means there is no layer 4(no ports).

There would be an issue when IPsec is going through a device which is doing PAT(overload NAT). PAT uses TCP or UDP port in order to identify the return traffic and replace the public IP with a correct private IP as packets return; however, there is no port in the encrypted packet.

The solution is NAT-traverse. Nat-traverse encapsulates packets in UDP headers with port 4500 so there will be no problem with PAT anymore.

I hope it is clear.

Masoud

[shivaram840]

Thanks masoud , you made me happy with your post and answer 

but after disabling the NAT-T on ASA firewall still able to ping Destination IPs ?

tunnel is there between ASA to ASA firewall and disabled NAT-T on one firewall though able to ping both sides 

Thanks,

Shiva

[Masoud Pourshabanian]

You do not need to enable NAT traverse between two ASAs. Is there any device between two ASAs doing PAT?

NAT-traverse is used in the following scenario. Usually remote access VPN, not site-to-site.

Client(remote IPsec client)-----------router or a device(PAT)----internet----VPN server.

That device(PAT) causes problem because it does not see any ports to use for PAT.

You enable NAT-traverse on client. Client encapsulates the encrypted packets in UDP headers with port 4500. Now device(PAT)  can use that port.

Hope it is clear now.