Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I've had a persistent problem establishing phase 1 of an IPsec tunnel I am initiating from an endpoint at my site to a vendor.

It is a bit of an odd configuration and I am not sure if NAT-T must be enabled in order for it to work.

  • The IP of my interface is
  • The source IP of the IPsec packets is
  • The source IP of the IPsec packets when traversing "the cloud" is a public address.

    == twice IPsec packets are NATed

It is unclear (unfortunately blind to me), to see if the firewall is actually NATing the packets, or actually assigning the source address when the packets are being generated. [yes, I seriously can't see it]

Under which circumstances is NAT-T required by an IPsec tunnel in order for it to establish?

Is it required in the situation described above?

I'm hoping to test, but the vendor is resistant.



share|improve this question
up vote 5 down vote accepted

NAT-T would be required in this situation, as you are using NAT. If NAT-T is not used the IPSec packets are modified in transit during the NAT process, which invalidates them. While NAT-T is used, the IPSec packets are encapsulated in UDP packets, preserving the original packets.

share|improve this answer
Thanks for your clarity. – mbrownnyc Oct 24 '11 at 15:07

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.