NAT-T

networking

NAT Traversal: IPsec's repair for address translation - detecting NAT in IKE and re-wrapping ESP in UDP/4500 so per-flow ports exist again.

The port-varies property that also lets multiple tunnels share one source IP.

NAT traversal lets IPsec work through address translation, which it otherwise cannot, because ESP has no ports for a translator to rewrite and its integrity check covers fields that translation modifies.

The solution is to encapsulate ESP in UDP on port 4500, giving the translator something it understands and leaving the protected payload intact. Detection happens during the key exchange, where both ends compare hashes of what they think the addresses are and notice when they disagree. Keepalives are needed because a translation entry expires on idle, and a tunnel that works and then silently stops after a quiet period is almost always this.

Also known as: nat traversal

← All glossary entries