NAT traversal

A gateway behind NAT

Lesson 8 of 20 · 11 min · Module 3: Real networks

IPsec was designed for gateways with public addresses. Many do not have one, and then the encrypted packets need help to get through.

Start this lesson →

Free. No installation: you write and run the code in your browser, and it is checked automatically.

By the end, you’ll be able to…

Explain why plain ESP fails behind NAT
Say what NAT traversal changes
Recognise a tunnel that is up but carries no traffic

The idea

A NAT device rewrites addresses and, for most traffic, ports. ESP, the protocol that carries the encrypted data, has no ports, so most NAT devices cannot handle it. NAT traversal (NAT-T) solves this: when the gateways detect a NAT device between them, they wrap ESP in UDP port 4500, which NAT handles like any other UDP traffic.

nat-traversal on

01Three kinds of packets

IKE itself uses UDP port 500. ESP is its own IP protocol, number 50, with no ports. With NAT traversal, both IKE and ESP move to UDP port 4500 as soon as a NAT device is detected. A firewall in the path has to allow UDP 500 and UDP 4500, and ESP when no NAT is involved.

02The symptom: up, but nothing passes

IKE runs over UDP, so the negotiation succeeds even behind NAT and the status page says the tunnel is up. If NAT traversal is off, the data is sent as plain ESP, the NAT device drops or mangles it, and no traffic arrives. In this lab that appears as "UP, but no traffic passes".

03NAT traversal on real devices

IKEv2 detects NAT by itself. The setting exists mostly so that it can be turned off, which is rarely right.

# FortiGate
config vpn ipsec phase1-interface
    edit "to-branch"
        set nattraversal enable
    next
end

# Huawei USG
ike peer branch
 nat traversal

# Cisco IOS: on by default
crypto ipsec nat-transparency udp-encapsulation

# In front of the gateway, allow:
#   udp 500, udp 4500, and ESP (IP protocol 50)

Your turn

This gateway is behind a NAT device. The tunnel reports UP, yet nobody can reach the branch. Somebody turned NAT traversal off years ago for a device that is long gone. Correct the configuration so that the traffic passes.

What the checks look for

The tunnel is up
The encrypted traffic is wrapped in UDP 4500
Traffic between the offices passes, in both directions
The identities are unchanged

Try it in the editor →

Take this with you

Behind NAT, ESP travels inside UDP 4500. A tunnel that is up while no traffic passes is the classic sign that this is not happening.

Go a little further

List the three things a firewall in front of a VPN gateway has to allow, and decide which of them this tunnel actually uses.