[Webinar] Streamline your web hosting managementRegister Today

x
?
Solved

How does IPSec establish a connection if Nat-Traversal is disabled in the middle of the chain?

Posted on 2012-04-04
8
Medium Priority
?
705 Views
Last Modified: 2012-08-14
We have a situation where a remote-access VPN is established (Phase 1 & 2), and show crypto isakmp sa says "AM_ACTLIVE".   The ASA say zero packets encrypted or decrypted for this VPN.
We think it may be a firewall in the middle that does not allow NAT Traversal.

Is that a fair assumption?

How does the VPN get established if NAT Traversal is not active in the middle of the stream?

Thanks.
0
Comment
Question by:jimmycher
  • 3
  • 3
7 Comments
 
LVL 17

Expert Comment

by:TimotiSt
ID: 37810294
If phase 2 is established, then NAT-T should work.
Check out the access-list referenced in the crypto-map, may be the reason why no packages are encrypted.

Tamas
0
 

Author Comment

by:jimmycher
ID: 37810710
Tamas,
Are you saying that if I have Phase 2 established, then all the intermediate firewalls must have NAT-T ( or Nat0 ) enabled?  

 At least one other forum says that if IPSec is established, and no data is getting through, it is probably because NAT-T is NOT enabled on the intermediate firewall.
0
 
LVL 17

Accepted Solution

by:
TimotiSt earned 375 total points
ID: 37810782
As far as I know, NAT-T is enabled on the two IPSec peers. It encapsulates traffic in UDP, so the intermediate devices have to allow UDP port 4500 only, not specifically allow the NAT-T protocol. If UDP port 4500 is firewalled, then no traffic will pass through.

In cisco terminology, "nat 0" is a different animal, it's nat-exemption. Basically it won't translate the source address of packets going through the vpn tunnel, since you most likely don't want them translated.
0
Evaluating UTMs? Here's what you need to know!

Evaluating a UTM appliance and vendor can prove to be an overwhelming exercise.  How can you make sure that you're getting the security that your organization needs without breaking the bank? Check out our UTM Buyer's Guide for more information on what you should be looking for!

 
LVL 32

Assisted Solution

by:harbor235
harbor235 earned 375 total points
ID: 37812114
If you turn on NAT-T is automatically accepts udp 4500 on all interfaces, no need to craft ACLs, sort of like when you enable ssh on the outside interface from a particular source, you do not also need to add ACL entries. The hole is automatically configured, easier to use.


harbor235 ;}
0
 

Author Comment

by:jimmycher
ID: 37813848
Allow me to restate the question:

I have a remote VPN that is established (Phase I & II successful, and AM_ACTIVE), but zero traffic is encrypted or decrypted on the ASA.

What is the most likely problem?

Regards,
0
 
LVL 17

Expert Comment

by:TimotiSt
ID: 37814041
Can you share a sanitized config from the ASA? At least the crypto parts.
0
 

Author Comment

by:jimmycher
ID: 37816002
The config on the ASA side works well, as a second user from a different remote location (Texas) can log in and pass data.   The user in California was able to pass data, up to three weeks ago, when it dropped.  The California user has two laptops, both displaying the same indications i.e. IPSec established, but zero encaps/unencaps.   The California user is behind multiple firewalls to get to the internet.   Sorry I can't provide the conifig, and it looks like I'm troubleshooting someone else's problem.   Could the problem be that one of his intermediate FWs is disabled for NAT-Traversal?   Would that give you IPSec, but no data?
0

Featured Post

Free Tool: ZipGrep

ZipGrep is a utility that can list and search zip (.war, .ear, .jar, etc) archives for text patterns, without the need to extract the archive's contents.

One of a set of tools we're offering as a way to say thank you for being a part of the community.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article is in regards to the Cisco QSFP-4SFP10G-CU1M cables, which are designed to uplink/downlink 40GB ports to 10GB SFP ports. I recently experienced this and found very little configuration documentation on how these are supposed to be confi…
Considering cloud tradeoffs and determining the right mix for your organization.
With Secure Portal Encryption, the recipient is sent a link to their email address directing them to the email laundry delivery page. From there, the recipient will be required to enter a user name and password to enter the page. Once the recipient …
In this brief tutorial Pawel from AdRem Software explains how you can quickly find out which services are running on your network, or what are the IP addresses of servers responsible for each service. Software used is freeware NetCrunch Tools (https…
Suggested Courses
Course of the Month11 days, 5 hours left to enroll

612 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question