User's Manual

Chapter 14 VPN
P-2612HW Series User’s Guide
280
allows you to set up an IKE SA when there are NAT routers between the two IPSec
routers.
Figure 167 NAT Router Between IPSec Routers
Normally you cannot set up an IKE SA with a NAT router between the two IPSec
routers because the NAT router changes the header of the IPSec packet. NAT
traversal solves the problem by adding a UDP port 500 header to the IPSec
packet. The NAT router forwards the IPSec packet with the UDP port 500 header
unchanged. In Figure 167 on page 280, when IPSec router A tries to establish an
IKE SA, IPSec router B checks the UDP port 500 header, and IPSec routers A and
B build the IKE SA.
For NAT traversal to work, you must:
• Use ESP security protocol (in either transport or tunnel mode).
•Use IKE keying mode.
• Enable NAT traversal on both IPSec endpoints.
• Set the NAT router to forward UDP port 500 to IPSec router A.
Finally, NAT is compatible with ESP in tunnel mode because integrity checks are
performed over the combination of the "original header plus original payload,"
which is unchanged by a NAT device. The compatibility of AH and ESP with NAT in
tunnel and transport modes is summarized in the following table.
Y* - This is supported in the ZyXEL Device if you enable NAT traversal.
Table 88 VPN and NAT
SECURITY
PROTOCOL
MODE NAT
AH Transport N
AH Tunnel N
ESP Transport Y*
ESP Tunnel Y
Internet
A
B