NAT Trasversal feature on ISR 4321 with IOS XE SDWAN image

[mayanksingh1809]

I am looking to integrate Cisco ISR 4321 (IOS XE SDWAN) capable router , sitting behind firewall with Zscaler Public IP's?

Please note that I can't provision public IP/Internet link directly on the SDWAN router. Zscaler ZEN node supports IPsec tunnels with NAT-Transversal feature.

Can someone please guide  if this is possible through NAT-T feature??? IPsec tunnel will use the public IP on my WAN firewall and destination as ZEN node IP in the region? What option should i choose in device templates to do NAT-transversal?? IPsec tunnels on IOS-XE-SDWAN routers are service-side tunnel..

[Kanan Huseynli]

Hi,

https://www.cisco.com/c/dam/en/us/td/docs/solutions/CVD/SDWAN/zscaler-cisco-sdwan-deployment-guide-2020feb.pdf

this document describes zscaler deployment.

See 1.7.1GRE and IPsec Tunnel section, it shows that:

IKE uses UDP port 500, or in the case of NAT traversal, UDP 4500

So, basically NAT-T is supported. Config should not be different than normal, just allow UDP500/4500 on your Firewall.

HTH,