Cisco FMC/FTD site-to-site VPN 'set nat-t disable' LINA configuration

[andrew.butterworth]

When creating a policy-based VPN on FMC, how do you get the CLI equivalent of what would be configured on an ASA as 'crypto map CSM_outside_map 1 set nat-t disable' to get configured on the FTD?

With ASDM its a tick box in the Advanced, Crypto Map Entry section or from the CLI its 'crypto map <name> 1 set nat-t disable'.

With FMC, there is a tick box for 'Enable NAT Traversal' when editing the local endpoint, but not the remote, however this doesn't translate to applying the same LINA command.

Disabling NAT Keepalive messages in the Advanced Tunnel section, applies the global command 'no crypto isakmp nat-traversal', however this is global and I need to do it on a peer basis.

FMC/FTD 7.2.5

[MHM Cisco World]

And one you control you can disable NAT-T?

MHM

[andrew.butterworth]

I can untick the box to disable NAT-T, however it doesn't change the configuration on the FTD:

I want to add the line 'set nat-t disable' to the crypto map.

[MHM Cisco World]

؟crypt map CSM_outside_map 1 set nat-t-disable؟

Add "?" in start and end of command 

I found bug and it work around is add "?" 

MHM

[andrew.butterworth]

I've just tried that and FMC throws an error.  This is the transcript:

If I try without the ? I get this:

[MHM Cisco World]

When you check ftd' are the crypo map have seq 1 or other seq ?

MHM

[tvotna · Accepted solution]

Of course it will throw an error, because the Lina CLI generated by FMC (or rather CSM running on the box) is not correct: "... set nat-t disable". It should have been "... set nat-t-disable". This is simply a bug.

[andrew.butterworth]

Lol, how did I miss that...  Wood & trees comes to mind.

[andrew.butterworth]

Hi Pavan, I tried that and FMC still throws up an error.  I'm guessing missing the 'o' off is an attempt to fool FMC

[Max Jobs]

Hi Andrew, it seems that the commands being entered are not compatible with FMC. Maybe it's better to contact Cisco support.

Dolphins do not like underwear!