Which protocols have trouble with NAT, and why?
Show the answer
Say this first
Protocols that carry addresses or ports inside the payload, and protocols with no ports at all. FTP puts addresses in its PORT and PASV commands. SIP and SDP carry the RTP media address. IPsec AH protects the IP header, so any rewrite breaks it, and ESP has no ports for PAT to use. NAT devices patch some of this with application layer gateways (ALGs), IPsec uses NAT traversal over UDP 4500, and VoIP usually relies on STUN, TURN and ICE or a session border controller.
Go deeper
| Protocol | Problem | Usual fix |
|---|---|---|
| FTP active | client sends PORT with its private address, server connects back to it | FTP ALG, or passive mode |
| FTP passive, server behind NAT | the PASV reply carries the server's private address | ALG, or tell the server its public address |
| SIP | SDP carries the private RTP address and port | SBC, STUN, TURN, ICE; ALGs often make it worse |
| IPsec AH | integrity check covers the IP addresses | cannot be NATed, use ESP |
| IPsec ESP | no ports, PAT cannot tell flows apart | NAT-T, ESP wrapped in UDP 4500 |
| PPTP | GRE with no ports | ALG, though PPTP itself is obsolete |
| Inbound peer to peer | no mapping exists | port forwarding, UPnP or PCP, hole punching |
ALGs on IOS
IOS NAT inspects and rewrites FTP, SIP and other protocols by default. Voice providers often ask you to turn the SIP ALG off because it mangles messages their SBC already handles:
no ip nat service sip udp port 5060
no ip nat service sip tcp port 5060Timers
Quiet UDP flows lose their mapping when the NAT UDP timer expires (300 seconds on IOS, often less on consumer routers). Keepalives from the endpoints keep mappings alive.
They will ask next
Calls connect through NAT but audio only flows one way. Where do you look?
The SDP in the SIP messages. If the
c=line carries a private address, the far end sends media to an address it cannot reach. Then check whether an ALG rewrote it wrongly and whether the firewall lets the RTP ports back in.How does IPsec know there is a NAT in the path?
IKE peers exchange NAT detection payloads, hashes of the addresses and ports they think they are using. If the hashes do not match what arrives, a NAT changed something, so the peers move from UDP 500 to UDP 4500 and wrap ESP in UDP.
Traps
- Saying IPsec cannot work through NAT. ESP with NAT-T works; only AH cannot.