Absolutely Cisco IPSEC vpn's DMVPN, Static IPSEC or GRE/IPSEC all use UDP 4500 (nat-t) when nat is detected in the path during IKE phase 1.
i just labbed this up for you in dynamips.
I have provided the config files for the spoke1 router and the ISP Edge router, doing the nat.
Please review.
Note: an access-list on the core monitoring the traffic confirms the fact the DMVPN traffic is nat'd inside of UDP 4500 packets. this is true for static one to one nat of the spoke and overload pat.
show crypto ipsec sa on SPOKE1 also confirms this.
SPOKE1#show crypto ipsec sa
interface: Tunnel1
Crypto map tag: Tunnel1-head-0, local addr 10.230.1.2
protected vrf: (none)
local ident (addr/mask/prot/port): (10.230.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (67.80.80.1/255.255.255.255/47/0)
current_peer 67.80.80.1 port 4500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 44, #pkts encrypt: 44, #pkts digest: 44
#pkts decaps: 48, #pkts decrypt: 48, #pkts verify: 48
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 43, #recv errors 0
local crypto endpt.: 10.230.1.2, remote crypto endpt.: 67.80.80.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0x68C5857E(1757775230)
inbound esp sas:
spi: 0x5580D9D9(1434507737)
transform: esp-192-aes esp-sha-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 2001, flow_id: SW:1, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (4396212/86195)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
spi: 0xFE115B08(4262550280)
transform: esp-192-aes esp-sha-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 2003, flow_id: SW:3, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (4383091/86195)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
inbound ah sas:
inbound pcp sas:
outbound esp sas:
spi: 0xC469E3A(205954618)
transform: esp-192-aes esp-sha-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 2002, flow_id: SW:2, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (4396212/86195)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
spi: 0x68C5857E(1757775230)
transform: esp-192-aes esp-sha-hmac ,
in use settings ={Tunnel UDP-Encaps, }
conn id: 2004, flow_id: SW:4, crypto map: Tunnel1-head-0
sa timing: remaining key lifetime (k/sec): (4383093/86195)
IV size: 16 bytes
replay detection support: Y
Status: ACTIVE
outbound ah sas:
outbound pcp sas:
protected vrf: (none)
local ident (addr/mask/prot/port): (10.230.1.2/255.255.255.255/47/0)
remote ident (addr/mask/prot/port): (66.118.90.1/255.255.255.255/47/0)
current_peer 66.118.90.1 port 4500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 31, #pkts encrypt: 31, #pkts digest: 31
#pkts decaps: 20, #pkts decrypt: 20, #pkts verify: 20
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#send errors 51, #recv errors 0
local crypto endpt.: 10.230.1.2, remote crypto endpt.: 66.118.90.1
path mtu 1500, ip mtu 1500, ip mtu idb FastEthernet1/0
current outbound spi: 0xEDD35CF(249378255)
ISP-CORE#show access-list
Extended IP access list 101
10 permit esp any any log
20 permit udp any any eq non500-isakmp (48 matches)
30 permit ip any any (21 matches)
-Joe
