VPN through NAT?

[Brian Candler]

On Mon, Aug 14, 2006 at 11:53:04AM -0700, Chuck Swiger wrote:
> If you have multiple clients trying to use the VPN from behind NAT,  
> note that you can only have one VPN endpoint per externally routable  
> IP

This depends on the implementation of your IPSEC termination device.

The tests I've done are using L2TP over IPSEC transport mode as the VPN
access method.

The following termination devices work properly, even with multiple clients
behind the same NAT firewall, or multiple clients using the same local IP
address (e.g. 192.168.1.1) but behind different NAT firewalls.

* Cisco IOS (you need a recent version and "set nat demux")
* Juniper ERX310

However, the following do not:

* Juniper Netscreen
* Linux (l2tpd)
* FreeBSD (sl2tps)

There's no fundamental reason why it can't work - the firewall simply NATs
each stream to a different UDP source port. It's just that many IPSEC
implementations don't take NAT-T into account when looking up SPIs in their
SADB.

Regards,

Brian.