5/29/2017 NATTraversaltutorialIPSecoverNAT

NATTraversaltutorialIPSecoverNAT

NATT(NATTraversal)
NatTraversalalsoknownasUDPencapsulationallowstraffictogettothespecified
destinationwhenadevicedoesnothaveapublicaddress.Thisisusuallythecaseifyour
ISPisdoingNAT,ortheexternalinterfaceofyourfirewallisconnectedtoadevicethat
hasNATenabled.

AswellasIPSecprovidingconfidentiality,italsoprovidesauthenticityandintegrity.Now
theproblemiswhenaNATdevicedoesitsNATtranslations,theembeddedaddressof
thesourcecomputerwithintheIPpayloaddoesnotmatchthesourceaddressoftheIKE
packetasitisreplacedbytheaddressoftheNATdevice.Thismeansbreakingthe
authenticitywhichwillcausethepacketbytheremotepeertobedropped.Sowhenthe
NATdevicealtersthepacket,it'sintegrityandauthenticationwillfail.

Alsoinsomecasesdependingonthelevelofencryption,thepayloadandinparticular
theheadersareencryptedwhenusingIPSecESPmode.TheNATdevicecannotchange
theseencryptedheaderstoitsownaddresses,ordoanythingwiththem.

TheNATdeviceinthemiddlebreakstheauthenticity,integrityandinsomecasescan
notdoanythingatallwiththepacket.ItisclearNATandIPSecareincompatiblewith
eachother,andtoresolvethisNATTraversalwasdeveloped.NATTraversaladdsaUDP
headerwhichencapsulatestheIPSecESPheader.AsthisnewUDPwrapperisNOT
encryptedandistreatedasjustlikeanormalUDPpacket,theNATdevicecanmakethe
requiredchangesandprocessthemessage,whichwouldnowcircumventtheabove
problems.AlsoenablingNatTraversalonthegatewaysresolvestheproblemwiththe
authenticityandintegritychecksaswell,astheyarenowawareofthesechanges.

Duringphase1,ifNATTraversalisused,oneorbothpeer'sidentifytoeachotherthat
theyareusingNATTraversal,thentheIKEnegotiationsswitchtousingUDPport4500.
AfterthisthedataissentandhandledusingIPSecoverUDP,whichiseffectivelyNAT
Traversal.ThereceivingpeerfirstunwrapstheIPSecpacketfromitsUDPwrapper(the
NATTraversalpartthatoccurredatthesendingpeerend)andthenprocessesthetraffic
asastandardIPSecpacket.

ThreeportsinparticularmustbeopenonthedevicethatisdoingNATforyourVPNto
workcorrectly.TheseareUDPport4500(usedforNATtraversal),UDPport500(used
forIKE)andIPprotocol50(ESP).

HowevertheultimatefixtothisistouseapublicIPaddressonyourfirewallsexternal
interface.Thisisalsotherecommendedmethod,andwilleliminatetheuseofNATT.

http://www.internetcomputersecurity.com/VPNGuide/NATT.html 1/1