I know that if you mess with IPsec header it will drop the packet and NAT is build exactly for that. How do they deploy IPsec where NAT is also needed.
1 Answer
Generally, IPSec NAT-Traversal (NAT-T) is used, where all the IPSec packets get wrapped in UDP packets on port 4500. The outer, unencrypted UDP/IP headers get modified by the NAT, but the IPSec headers inside do not. The receiving host strips away the outer UDP/IP headers and then handles the inner IPSec packet in the normal way.