0

I know that if you mess with IPsec header it will drop the packet and NAT is build exactly for that. How do they deploy IPsec where NAT is also needed.

1
  • What has your research tell you? It can be done and IETF RFC 3715 addresses this specifically... And Google will find you tons of articles on how it can be done.
    – acejavelin
    Apr 2, 2016 at 21:14

1 Answer 1

1

Generally, IPSec NAT-Traversal (NAT-T) is used, where all the IPSec packets get wrapped in UDP packets on port 4500. The outer, unencrypted UDP/IP headers get modified by the NAT, but the IPSec headers inside do not. The receiving host strips away the outer UDP/IP headers and then handles the inner IPSec packet in the normal way.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .