IPsec Over NAT
Network Address Translation (NAT) is a method to remap a private IP address to a public IP address by modifying the address information in the IP packet. This is done by the transit routers when the traffic passes through them.
This method allows you to limit the number of public IP addresses that could be owned by a user. In basic NAT (one-to-one NAT), there is one-to-one mapping of IP addresses. However, an effective NAT method is Port Address Translation (PAT), where many private addresses will map to a single public IP address.
An IPsec ESP packet does not contain port information like TCP and UDP. Therefore, a NAT (PAT) device is unable to do mapping and drops the packet. This is overcome by NAT Traversal (IPsec over NAT), which encapsulates the ESP packet inside a UDP header.
NAT Traversal is enabled by default. In FIPS mode, NAT Traversal cannot be disabled. In non-FIPS mode, you can disable NAT Traversal on an as-needed basis.
Note: One of the primary use cases of IPsec is the remote access to a corporate network for telecommuters and employees accessing through a VPN. And this use case relies on NAT. Therefore, it is essential to provide NAT Traversal for IPsec.
On the receiving end, the hashes of the IP address and port are calculated in the packet header. These are compared with the hashes received as part of the NAT-D payload. If they are different, it means the packet has undergone NAT. After this negotiation, the IPsec tunnel will be established with UDP encapsulation. In the UDP encapsulation, both source and destination ports will be set to 4500.
In UDP encapsulation, an ESP packet is treated like a UDP packet and NAT is applied normally without affecting the ESP packet inside.
Note: An SPI value of 0 (zero) must not be used in the SPI field of ESP packets. This is to distinguish IKE and ESP packets.
NAT Configuration
NAT is enabled by default. To disable NAT, use the ikev2 nat-disable command.
device(config)# ikev2 nat-disable
The no form of the command enables NAT.
device(config)# no ikev2 nat-disable