This detects if NAT is happening in the VPN path and where the NAT is occurring. The next thing that happens is NAT discovery (NAT-D). We also see the ASA computing its own NAT-traversal vendor ID payload to send to the VPN router. The ASA processes this packet and we see that NAT traversal is supported. This tells us that NAT traversal is supported by the device that sent this packet, i.e., the VPN router. Notice that the hex value of this payload is as discussed above. The part that we are concerned with is the vendor ID payload and one of the vendor ID payloads in the above packet is shown below: We are familiar with the first packet the ASA receives as shown below: I will turn on debugging at level 255 on the ASA so we can look into the content of the packets and then I will initiate a connection from the VPN router. LetвЂ™s look through our debugs to see if we find anything similar. This determination is done by an exchange of vendor ID payloads which are sent in the first and second messages of IKE phase 1. Both peers must first determine if the other peer supports NAT traversal and this occurs in IKE phase 1. This is the first aspect involved in NAT-T. There are three things involved with NAT-T that we will look at with the debug output. The only difference is the configuration of the Fa0/0 interface, as shown below: interface FastEthernet0/0 The configuration on the VPN router is the same as the configuration of the IOS router in this configuration. Let me highlight here that, since PAT is being used, only the VPN router can initiate the VPN connection the ASA cannot be the initiator. Ip nat inside source list NAT-ACL interface FastEthernet0/0 overload The configuration on the NAT router is shown below: hostname NAT-RTR We will translate the Fa0/0 interface (192.168.12.2) on the VPN router to the Fa0/0 interface IP address of the NAT router (10.0.0.2). The configuration on our ASA remains the same (the configuration we did for main mode). The VPN router is behind a NAT device that translates its VPN interface using PAT. The network diagram we will be using is as shown below: In this section, we will look at how NAT-T works. To resolves this, NAT-T assigns the checksum values in the new UDP packets to zero (meaning that checksums will not be validated). These checksums are dependent on the IP source and destination addresses, meaning that these packets will not pass the checksum check as they have passed through a NAT device. However, when using TCP or UDP, checksums must be performed on the packets. NAT-T will therefore wrap the ESP packets into UDP packets (which have ports) and the PAT device can perform the required translation.ДЄs we discussed above, NAT-T wraps ESP packets into UDP packets and sends them across the network. Because of this, PAT cannot handle ESP traffic by default. However, ESP is connectionless in the sense that it does not contain port information. PAT can handle TCP and UDP traffic properly because they have the necessary ports that it can translate. LetвЂ™s look at some of the issues IPsec runs into when NAT/PAT is in place and how NAT-T resolves them.ДЄH focuses on integrity (ensuring that data is not altered) and, in doing this, it uses the IP source and destination addresses as part of the message integrity if these addresses are changed via a NAT or PAT device, the message integrity check will fail.Д®SP, on the other hand, does not include the IP source and destination addresses in its integrity check, so it does not have this issue.Д®ncapsulating Security Payload (ESP) and PAT This means that, for local traffic, PAT will change the source IP address to the global PAT IP address and will also change the source port to a unique port. In the case of PAT, several local addresses are translated to one global address using different ports. NAT (or PAT) works by translating a local address or addresses to a public address or several public addresses. NAT traversal (NAT-T) is a feature that allows IPsec traffic to вЂњtraverseвЂќ through NAT or PAT points without the incompatibilities that would normally arise. In those articles, something about NAT came up in the debug outputs and we said we would talk about it in another article this is that article! We looked through the debug output for both main mode and aggressive mode of IKE Phase 1 and also the quick mode of IKE Phase 2. In previous articles, we looked in details of the internal workings of a site-to-site VPN between the Cisco ASA and a Cisco IOS router.

Debug ipsec vpn asa asdm