How does NAT traversal work in IPsec, and why is it needed?
Show the answer
Say this first
ESP has no ports, so a PAT device cannot tell flows apart, and any NAT breaks AH. NAT-T first detects NAT during IKE: each side sends hashes of the addresses and ports it believes it is using, and if what the peer receives does not match, there is a NAT in the path. The peers then move IKE to UDP 4500 and put every ESP packet inside a UDP 4500 header, which NAT devices handle like any UDP flow. Small keepalives hold the NAT mapping open.
Go deeper
IKEv1 (RFC 3947 and RFC 3948)
- Messages 1 and 2: vendor ID payloads show both sides support NAT-T.
- Messages 3 and 4: NAT-D payloads carry a hash of each side's address and port.
- If a received hash does not match what the receiver computes, NAT is present. From message 5 on, IKE uses UDP 4500.
- Data travels as IP, UDP 4500, ESP. IKE messages on UDP 4500 start with four zero bytes (the non-ESP marker); ESP never has an SPI of zero, so the receiver can tell them apart.
IKEv2
The same idea is built in: NAT_DETECTION_SOURCE_IP and NAT_DETECTION_DESTINATION_IP notifies in IKE_SA_INIT, then the switch to UDP 4500 from IKE_AUTH on.
Keepalives
A one-byte UDP packet (0xFF) refreshes the NAT mapping. On IOS: crypto isakmp nat keepalive 20.
Cost
8 more bytes per packet for the UDP header. Leave room for it in the tunnel MTU.
They will ask next
What do you forward on a firewall that sits in front of a VPN gateway doing NAT?
UDP 500 and UDP 4500 to the gateway. ESP protocol 50 is not used once NAT-T is active.
A tunnel through NAT works, then dies after a few idle minutes. Why?
The NAT device timed out the UDP 4500 mapping, so packets from the far side no longer reach the gateway. Make the NAT-T keepalive interval shorter than the NAT idle timeout, or keep traffic flowing with DPD or routing hellos.
Traps
- Saying NAT-T only moves IKE to UDP 4500. ESP moves into UDP 4500 too.