Does both peers should enable Nat-T ?

[aehtibarov]

Hi community,

I have ftd on my site with private address and then internet router that does nat.(Remote peer`s device is HPE HSR6602) Question is "do both peers needs to enable nat-t on ipsec configuration? or enabling on one side is enough? If so, does it matter which side is enabled nat-t?"

[Karsten Iwen · Accepted solution]

Both devices need to have NAT-T enabled. If one end has it disabled, the additional UDP-encapsulation can not be negotiated.

[MHM Cisco World]

NAT-PT is supported by HPE

do you face issue ?

[aehtibarov]

İssue was solved. I understood that on HPE device nat-t was automatically enabled. Problem was on phase2 with Deffie Hellman group, changing DH5 to DH2 solved issue.

[Karsten Iwen]

Great that the problem is solved. But be aware that DH2 is not what is considered secure any more. The industry moves to DH14 and greater.

[harmesh88]

Both Side NAT T should be enabled then only vpn traffic will start transferring

[whistleblower14]

hi,

today I‘ve faced a strange behavior which I‘ve not seen before and which I don‘t understand

we‘d setup an IKEv1 IPsec tunnel between an ASA and a barracuda firewall; the tunnel went up but no traffic was able to pass through… of course we checked multiple times the phase1 and phase2 parameters on both sides and everything looked correct and fine!

after some time we’ve been told that the barracuda firewall was sitting behind a nat device and after we enabled nat-t everything worked as expected! the question for me is, I‘ve always thought that if a problem with nat-t would exist than no phase1 could be exchanged beforehand and the tunnel would not came up anyway?!?! but why has this be ok in our setup and of course phase2 looked good but no traffic could pass?

[Karsten Iwen]

This is what is to be expected without NAT-T. All the Tunnel-negotiation is done with UDP and will work, the tunnels get established. But the IPsec-SAs will be "only" IP/ESP-encapsulated and can not pass through the PAT instance.

[rafail.sharifov]

Thanks