ZyXEL P-2812HNU-51c User Manual download pdf (Page 272)

100

101

Chapter 12 IPSec VPN

P-2812HNU-51c User’s Guide

272

Normally you cannot set up an IKE SA with a NAT router between the two IPSec

routers because the NAT router changes the header of the IPSec packet. NAT

traversal solves the problem by adding a UDP port 500 header to the IPSec

packet. The NAT router forwards the IPSec packet with the UDP port 500 header

unchanged. In Figure 137 on page 271, when IPSec router A tries to establish an

IKE SA, IPSec router B checks the UDP port 500 header, and IPSec routers A and

B build the IKE SA.

For NAT traversal to work, you must:

• Use ESP security protocol (in either transport or tunnel mode).

•Use IKE keying mode.

• Enable NAT traversal on both IPSec endpoints.

• Set the NAT router to forward UDP port 500 to IPSec router A.

Finally, NAT is compatible with ESP in tunnel mode because integrity checks are

performed over the combination of the "original header plus original payload,"

which is unchanged by a NAT device. The compatibility of AH and ESP with NAT in

tunnel and transport modes is summarized in the following table.

Y* - This is supported in the P-2812HNU-51c if you enable NAT traversal.

12.5.7 ID Type and Content

With aggressive negotiation mode (see Section 12.5.4 on page 270), the P-

2812HNU-51c identifies incoming SAs by ID type and content since this identifying

information is not encrypted. This enables the P-2812HNU-51c to distinguish

between multiple rules for SAs that connect from remote IPSec routers that have

dynamic WAN IP addresses.

Regardless of the ID type and content configuration, the P-2812HNU-51c does not

allow you to save multiple active rules with overlapping local and remote IP

addresses.

With main mode (see Section 12.5.4 on page 270), the ID type and content are

encrypted to provide identity protection. In this case the P-2812HNU-51c can only

distinguish between up to 12 different incoming SAs that connect from remote

Table 78 VPN and NAT

SECURITY

PROTOCOL

MODE NAT

AH Transport N

AH Tunnel N

ESP Transport Y*

ESP Tunnel Y

1 2 ... 267 268 269 270 271 272 273 274 275 276 277 ... 521 522

Comments to this Manuals

No comments

ZyXEL P-2812HNU-51c User Manual Page 272

Comments to this Manuals

Related products and manuals for Networking ZyXEL P-2812HNU-51c