VPN via NAT

[gongya]

I have the following topology

with NAT-T disabled on Cisco ASA (no crypto isakmp nat-traversal 20), I got the following

I thought the VPN should fail. What did I miss here ?

thanks a lot !!

[MHM Cisco World]

I dont get what you ask here ?

[gongya]

Sorry.  What I like to ask is

1. NAT-T must be enabled on both ends to bring VPN up? 

2. The test above only has NAT-T enabled on the remote peer, ASA has NAT-T disabled globally. The VPN is up.

3. It might be relate to that NAT I configured. The NAT above is static NAT.

I will try PAT to see whether VPN requires NAT-T enabled on both ends.

thanks so much !!

[Rob Ingram · Accepted solution]

@gongya with NAT-T disabled on either device, a VPN can be established when using Static NAT.

If using PAT this is when you need NAT-T on both devices, as ESP does not have ports to be translated.

[gongya]

thanks a lot !   Clear now.

[MHM Cisco World]

I think you misconfig the peer in crypto map, 
the static NAT work if you disable NAT-T. 

[gongya]

thanks a lot !!  clear now !!

[MHM Cisco World · Accepted solution]

You are so so welcome 

[gongya]

One more question to bother.

crypto isakmp nat-traversal 20

Does this command achieve both option 1 and option 2? or there are separate commands for either option ?

thanks so much !!

[Rob Ingram]

@gongya I've never used it, but it seems to be related to IKEv1 remote access VPN connections.

https://www.cisco.com/c/en/us/td/docs/security/asa/asa914/configuration/vpn/asa-914-vpn-config/vpn-groups.html?bookSearch=true

It's uses a different command to NAT-T to configure. To enable IPsec over UDP, configure the ipsec-udp command with the enable keyword in group-policy configuration mode, as follows:

hostname(config-group-policy)# ipsec-udp  {enable  | disable }
hostname(config-group-policy)# no ipsec-udp 

[gongya]

thanks so much !!