DMVPN with spoke befind PAT

[daniel-ma]

Cisco document shows that PAT is supported. However, I tried behind a Checkpoint firewall, as well as the Netgear router. None of the situation works. As soon as I move the router to public segment, the tunnel comes up.

Is there any special configuration we need to do on PAT device?

[Todd Pula]

You will want to ensure that NAT-T is being negotiated correctly and that the required ports/protocols such as UDP500, UDP4500, and ESP are not inadvertently filtered by your PAT device.