Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I have this weird problem where racoon complains of the following error:

WARNING: NAT-T is enabled in at least one remote{} section, but no 'isakmp_natt' address was specified!

I've already specified isakmp_natt though. Here's my racoon.conf:

path pre_shared_key "/var/etc/psk.txt";

path certificate  "/var/etc";

    isakmp [500];
    isakmp_natt [4500];

    auth_source system;
    group_source system;
    pool_size 125;

    ph1id 1;
    exchange_mode aggressive;
    my_identifier address;
    peers_identifier address;
    ike_frag on;
    generate_policy = off;
    initial_contact = on;
    nat_traversal on;

    dpd_delay = 10;
    dpd_maxfail = 5;
    support_proxy on;
    proposal_check claim;

        authentication_method pre_shared_key;
        encryption_algorithm 3des;
        hash_algorithm sha1;
        dh_group 2;
        lifetime time 28800 secs;

sainfo subnet any subnet any
    remoteid 1;
    encryption_algorithm aes 256, aes 192, aes 128, blowfish 256, blowfish 248, blowfish 240, blowfish 232, blowfish 224, blowfish 216, blowfish 208, blowfish 200, blowfish 192, blowfish 184, blowfish 176, blowfish 168, blowfish 160, blowfish 152, blowfish 144, blowfish 136, blowfish 128, 3des, cast128;
    authentication_algorithm hmac_sha1,hmac_md5;
    compression_algorithm deflate;

    lifetime time 3600 secs;


[ simon.cpu ]

share|improve this question
up vote 1 down vote accepted

You might need to recompile your kernel, with options IPSEC_NAT_T set in the kernel config.

share|improve this answer
Yepp, I think that was how we solved our problem... Thanks! – simoncpu May 28 '11 at 4:18

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.