wonder if someone can explain this:
Both Ra and Rb is using version 12.2(15)T17
Ra ip address is 192.168.1.2 and
it is NATted by the checkpoint to be
188.8.131.52. Rb ip address is 184.108.40.206
IPSec is between Ra and Rb for LanA and LanB.
Straight forward IPSec between Ra and Rb,
no GRE whatsoever.
On the checkpoint firewall, I have static
NAT for Ra from 192.168.1.2 to 220.127.116.11
and I have rule on the firewall to allow
EVERYTHING through the firewall.
On the router, I explicitly put in the
crypto ipsec nat-transparency udp-encapsulation
The VPN between Ra and Rb is working and traffic
between Ra and Rb is working; however, tcpdump
on the checkpoint firewall reveals that the routers
are using ESP (proto 50) instead of NAT-T (udp/4500).
I thought that if the VPN device detects that
it is behind a NAT device, it will use nat-t
instead of ESP. Furthermore, the command
I put into the router should be enough
to tell the routers to use udp/4500.
I asked Cisco about this before but they have an
answer for me either.