Re: VPN through NAT?

On Mon, Aug 14, 2006 at 12:19:30PM -0600, Jeff Norris wrote:

Brian,

IPSEC NAT traversal uses UDP 4500? Who implementation? Cisco, Nortel,
BSD?

Everybody, because it's the standard. See RFC 3947 and 3948

"Take the common case of the initiator behind the NAT. The initiator
must quickly change to port 4500 once the NAT has been detected to
minimize the window of IPsec-aware NAT problems.

In Main Mode, the initiator MUST change ports when sending the ID
payload if there is NAT between the hosts. The initiator MUST set
both UDP source and destination ports to 4500. All subsequent
packets sent to this peer (including informational notifications)
MUST be sent on port 4500."

I belive 4500 is Cisco's way of doing it, but not all IPSEC vpn
clients are the same. I use one that uses UDP port 10000 for nat
traversal.

There are many proprietary VPN solutions out there, of course, so it sounds
like you have one of these.

I've tested many standard solutions (Microsoft's IPSEC stack, FreeBSD with
ipsec-tools, Linux with ipsec-tools, Cisco IOS, Cisco PIX, Juniper
Netscreen, Juniper ERX, and some smaller vendors). All implement NAT-T
according to the standard. They mostly even interoperate :-)

Regards,

Brian.
_______________________________________________
freebsd-isp@xxxxxxxxxxx mailing list
http://lists.freebsd.org/mailman/listinfo/freebsd-isp
To unsubscribe, send any mail to "freebsd-isp-unsubscribe@xxxxxxxxxxx"

Relevant Pages

  • Re: Just an interesting note.
    ... with some protocols that need port forwarding from the internet ... There was no NAT at the Cisco rtr, only the actual IP routing functions. ... Linksys LAN side IP address. ...
    (alt.internet.wireless)
  • ISDN & Cisco 804 (IOS 12.1)
    ... apologies for total cluelessness on Cisco and ISDN in general. ... I'm attempting to get an ISDN access up and running in a small ... I thought I had found enough info on NAT and port forwarding to get ...
    (comp.dcom.sys.cisco)
  • Re: Tunnels to Cisco through NAT?
    ... If you update the Cisco firmware with the latest IOS+VPN version, ... needs you to forward a single UDP port... ... connected to a satellite connection. ... to get to the Cisco through a NAT. ...
    (freebsd-questions)
  • Re: o2 as internet connection sharing server
    ... SGI has an ipfilter available for download that does NAT. ... available for a while, but isn't shipping as a standard part of the OS, at ...
    (comp.sys.sgi.admin)
  • How do I set up Cisco 1600 nat port range for pasv ftp?
    ... The port range is what I have my ftp ... I set up the NAT ftp control port 21 with: ... I would like to do something like the following, but the cisco router ...
    (comp.security.firewalls)