IPSec VPN with one node behind a NAT

[gregoriobueno]

Hello,

I have 2 IP address, one is a public address and the other is a private. It´s possible to built a IPSec VPN between these 2 IP address? From the private IP address, I can reach the public one, but from the public address, I can´t reach the private one. With NAT Traversal, it´s possible to built this VPN? The only way I could built it was configuring a GRE tunnel between the 2 public ip address, and with two static routes. With this configuration, I could reach the private address from the public address.

There´s a attached picture to explain this scenario.

Thanks.

[itadminasf]

Yes it's possible, I've done it with 2 Cisco RV042.

In your VPN setup, for Security Gateway Type, chose Dynamic IP + Email address (USER FQDN) Authentication, for the router under the NAT.

Chose IP ONLY for the one with private IP address.

The router that is NATed will try to connect to the public IP one. When they connect, the dynamic will try to authenticate with the Email you have setup. See the Email address as a password. It can be anything, as long as you configure the same one in both routers.

Other things to mention, in the Advance+ setup, you need to select:

- Agressive mode

- NAT traversal

I suggest selecting also:

- Keep-Alive

- Dead Peer Detection Interval

Good luck and have anice day