...
| Payload encapsulation | |
|---|---|
| |
| Signaling | in ISAKMP ( IKE phase1 ) |
| 1st/2nd (3rd) packet |
|
in the 3rd and 4th packet( could be the 3rd ??? ) | payload: NAT-Discovery
|
NAT-T for IKE peer: NAT-T is used when there is a network device between the two tunnel end-points that enforce NAT.
all the IPSEC tunnerl to traverse the NATing equipement
Challenge: Any changes to the IP addressing, which is the function of NAT, causes IKE to discard packets
Solution: ESP over UDP/4500
After detecting one or more NAT devices ( by the firwall) along the datapath during Phase 1 exchanges,
>> NAT-T adds a layer of User Datagram Protocol (UDP) encapsulation to IPsec packets so they are not discarded after address translation.
edit security ike gateway gateway-name
[edit security ike gateway IKE-GW1]
...