How come it works VPN behind PAT

[dumlutimuralp]

Hi,

Everywhere it says, " if PAT is applied when a client tries to make a VPN connection to a remote site you need to enable IPSEC over UDP over TCP or NAT-T . The thing is I use an ADSL modem at home. And even when I disable transparent tunnelling on my Cisco VPN Client software the VPN connection works ok ? How can this be possible. Isnt it known as IPSEC packets can not be PATed ?

[gfullage · Accepted solution]

MOST devices have trouble PAT'ing IPSec packets, simply becuase there is no TCP or UDP port number to base the PAT on. It isn't that the packets cannot be PAT'd, it's just that most devices aren't smart enough to be able to do it, and therefore you need to encapsulate your IPSec packets into UDP or TCP.

I would simply say your ADSL modem is smart enough to figure out you're using IPSec and it will PAT it based on some other value in the packet. You may have issues starting two clients from behind this device, as the PAT device will quite often be only able to handle one.

Cisco routers have been able to do this since 12.2(15)T code, so it's not unusual that it does work.

[m.batts]

Hi,

I had the same query.It turned out that the Netgear routers we were using support VPN passthrough which stops the router from messing with the vpn packets and hence NAT-T or such like is not needed.

mark