UDP hole punching

[prince.p]

can anyone explain what is udp hole punching in network . is udp hole punching is same s NAT

[Flavio Miranda]

Hi @prince.p

  This is a technique used to traverse  NAT and allow UDP communication.

 A very good application for this technique is when you have a firewall behind a router  and the router  hold the public IP address but you need to establish VPN with firewall which have private IP address.

 You need UDP Hole punching technique on router in order for port 500 VPN make it through router and get to the firewall so that VPN can be established.

 There are lot of scenarios where is technique is necessary.

 So, this is a technique that allows UDP communication through NAT.

-If I helped you somehow, please, rate it as useful.-

[prince.p]

can you share some brief about NAT traverse and udp hole punching

[Flavio Miranda]

Of course. 

 On the example I mentioned and many others, UPD packets may have trouble traversing NAT. So the idea of punching is open a communication channel so that UDP can make it through the NAT (traverse).

 With hole punching after the "hole" is openned, the channel is maintained with empty udp packets with no communication is sent.

-If I helped you somehow, please, rate it as useful.-

[prince.p]

hi thanks for your help to get knowledge about UDP hole punching. i am some
doubt in NAT traversal .

Is NAT Traversal can be configured manually in firewall to open the port
like port forwarding or it is working with some application program to open
the port permanently for UDP hole punching

[prince.p]

hi thanks for your help to get knowledge about UDP hole punching. i am some
doubt in NAT traversal .

Is NAT Traversal can be configured manually in firewall to open the port
like port forwarding or it is working with some application program to open
the port permanently for UDP hole punching

[Flavio Miranda · Accepted solution]

It is more like a feature but can be enabled and disable. If I am not wrong, in Cisco firewall it is disabled by default and on Cisco router enabled by default.

You can take a look on the command " crypto isakmp nat-transversal"

-If I helped you somehow, please, rate it as useful.-

[antonkolev]

Have you actually tested if this works  for Site to Site VPN tunnels  between two ASA or FTD firewalls