Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

A customer of ours is setting up an ISA-Cluster in private network address range and we have to build a VPN connection with them. There is no way avoiding NAT-T and this is where we get to a problem:

in IKE request there is a field ENCAPSULATION_MODE where there should be a value of 3 for NAT-T if you go by the book (RFC3947).

However Ciscos and it seems Microsoft ISA still send historical value of 61443 which is accepted by OpenBSD (tolerant, good). But - there is no way to make OpenBSD send a request with ENCAPSULATION_MODE = 61443 and the "standard" value 3 is rejected by Microsoft ISA.

Anybody knows a solution to this?

It'd be nice to hear of a patch for MS ISA allowing it to accept the "3"...

Update: "The other side" has MS ISA 2006 Enterprise. "Our side" has OpenBSD 4.5.

share|improve this question
Liiks like we'll have to either: a) hack our OBSD b) use a cisco – slovon Sep 1 '09 at 5:45
up vote 1 down vote accepted

The solution was to configure the VPN connection on the OpenBSD side totaly manually (isakmpd.conf instead of ipsec.conf) and use ENCAPSULATION_MODE=UDP_ENCAP_TUNNEL_DRAFT in quick mode custom transform definition.

Hooray for configurability!

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.