How NAT-T Works

NAT’s useful, but can also cause us problems. For example, if an application embeds an IP address in the payload of a packet, it won’t be changed by NAT. Only the IP in the IP header will. This may cause the application to behave badly.

IPSec is one of these applications. It will see this as packet tampering (a security threat) and drop the packet. NAT Traversal (NAT-T) is a way to work around this.

NAT-T encapsulates the traffic in another layer of UDP. This way, NAT will change the outside layer, and not the inside headers. When the packet arrives, the NAT-T headers are removed, leaving the original header, with the IP addresses intact.

Overview of this video:

0:00 The Problem with NAT

0:50 IPSec with NAT

1:49 NAT Traversal

LET'S CONNECT

#NetworkDirection
#networking

[oritzhak]

thank you very much, not a lot of istructor talk about this.

[hamedmoradi]

Very simple and clear explanation! Thank you!

[tayzzed]

That is not totally correct. First of all UDP 500 will always be used and seen regardless of NAT-T being used as this is when it will determine if NAT-T needs to be used. If NAT-T is determined then UDP port 4500 is basically used for IPSEC connection because a router or firewall can then track the NATTED connection using port numbers whereas if it used ESP protocol it can't NAT that traffic because its a protocol that doesn't use port numbers like TCP or UDP does.

[denysolleik]

How does the destination know the source IP has been modified? It doesn’t care.

[pigrebanto]

thanks! So the extra IP and UDP Headers sections get modified by a NAT device but it does not matter because the internat headers are presenreved, right? On the other side the NET-aware router strips the external headers regardless (all the time, all packets)?

[kcgfy]

Can I use any port other than 4500 for NAT-T?

[saravanavigneshsrihari]

hi guys d
does anyone know How does AH mode act in NAT T