IPsec between two Router through ASA

balsheikh · ‎03-27-2007

Hi,

I'm running IOS 12.4(3a) on my router 2821. The router is doing NAT for certain IPs and acting as VPN L2L termination point. My network setup as follow:

My Router ------ ASA ------- Internet Router ------ Peer Router

Note:

The same interface on the router used for NAT and IPsec termination.

Actually the IPsec traffic passed all the way through the ASA firewall to the internet router finally to the destination Peer router. I?ve noticed that I have to enable NAT-T on ASA to bring the IPsec tunnel up and running, I did it and it?s up.

But now my router negotiates the ISAKMP SA on port 4500 because of NAT-T and the peer router responds back on port 500, it?s a mess, for every 100 ICMP sent packets I got almost 15 ? 20 dropped packets which it is unacceptable behavior at all.

I need to know the possibility to have a workaround to avoid NAT-T or configuring QOS.

Appreciate any useful assistance..

Regards,

cairnsm · ‎03-29-2007

A couple of things:

1 You can disable nat-t on the router with no crypto ipsec nat-traversal udp-encap.

2. IPSec can traverse a NAT as ESP protocol 50 as long as it is a one to one translation.

HTH,

Mark

balsheikh · ‎03-30-2007

Hi Mark,

NAT-T implemented on the ASA not on the VPN router to permit the IPsec tunnel to be established through it.

I'm totally agree with u on point 2 but once I disabled the NAT-T on the ASA I can't initiate the VPN connection from my side (the remote side should initiate the connection to bring the tunnel up). something strange!!

Regards,

Belal

cairnsm · ‎03-30-2007

Belal,

NAT-T on the ASA should only be needed for clients terminating a VPN tunnel on the ASA from behind a NAT device outside (like a home Linksys router). Do you have a static one to one NAT on the ASA to translate your inside router to an outside address or does the router fall into a nat pool that translates to a global outside address?

Mark

balsheikh · ‎03-31-2007

Hi Mark,

okay.. but is there any explanation why once NAT-T disabled on ASA the Ipsec tunnel between routers goes down !!

actaully I have multiple static translations with a VPN clients configured on the ASA.

Regards,

Belal