NAT-T over PAT

[hanwucisco]

I think starting from IOS 12.3, NAT-T is automatically enabled. Does it mean you need not do do anyting, it will work when you configure IPSec VPN across PAT? In my case, it doesn't. The VPN IPSec encrypted packet number doesn't increase. When I take off either of the PAT or VPN, the other works.

Any idea?

thanks,

Han

[Gustavo Medina]

Yes, It is enabled by default meaning that if after discovering that either side is behind NAT then the ESP packets will get encapsulated into UDP 4500 packets. Is someone in the middle blocking UDP 4500? Are you allowing UDP 4500 on the access-group applied to the outside interface? Does the tunnel get established when negotiating NAT-T? could you attach the "sh crypto ipsec sa"?

--Tavo