| Home Prev |  cOS Stream 4.00.03 Administration Guide
|
Next |
|---|
Both the IKE and IPsec protocols present a problem in the functioning of NAT. Both protocols were not designed to work with NAT and because of this, a technique called NAT Traversal (NAT-T) has evolved. This is an add-on to the IKE and IPsec protocols and it allows them to function when being NATed.
The Clavister NetShield Firewall supports the following standards for NAT traversal with IKE:
NAT traversal is divided into two parts:
Additions to IKE that lets IPsec peers tell each other that they support NAT traversal, and the specific versions supported.
Changes to the ESP encapsulation. If NAT traversal is used, ESP is encapsulated in UDP, which allows for more flexible NATing.
NAT traversal is only used if both ends have support for it. For this purpose, NAT traversal aware VPNs send out a special "vendor ID" to tell the other end of the tunnel that it understands NAT traversal, and which specific versions of the draft it supports.
The NAT Detection Mechanism
To achieve NAT detection, both IPsec peers send hashes of their own IP addresses along with the source UDP port used in the IKE negotiations.This information is used to see whether the IP address and source port each peer uses is the same as that which the other peer sees. If the source address and port have not changed, then the traffic has not been NATed along the way, and NAT traversal is not necessary. If the source address and/or port has changed, then the traffic has been NATed, and NAT traversal is used.
Changing Ports
Once the IPsec peers have decided that NAT traversal is necessary, the IKE negotiation is moved away from UDP port 500 to port 4500. This is necessary since certain NAT devices treat UDP packet on port 500 differently from other UDP packets in an effort to work around the NAT problems with IKE. The problem is that this special handling of IKE packets may in fact break the IKE negotiations, which is why the UDP port used by IKE has changed.UDP Encapsulation
Another problem that NAT traversal resolves is that the ESP protocol is an IP protocol. There is no port information as we have in TCP and UDP, which makes it impossible to have more than one NATed client connected to the same remote gateway and at the same time. Because of this, ESP packets are encapsulated in UDP. ESP-UDP traffic is sent on port 4500, the same port as IKE when NAT traversal is used. Once the port has been changed, all following IKE communication is done over port 4500. Keep-alive packets are also sent periodically to keep the NAT mapping alive.NAT Traversal Configuration
Most NAT traversal functionality is completely automatic and in the initiating firewall no special configuration is needed. However, for responding firewalls the following two points should be noted:On responding firewalls, the Remote Endpoint field is used as a filter on the source IP of received IKE packets. This should be set to allow the NATed IP address of the initiator.
When individual pre-shared keys are used with multiple tunnels connecting to a single remote VPN peer which are then NATed out through the same address, it is important to make sure the Local ID is unique for every tunnel. The Local ID can be one of the following:
