wonder if someone can explain this:

LanA--Ra---CheckpointNGx_Fw---Rb--LanB

Both Ra and Rb is using version 12.2(15)T17

Ra ip address is 192.168.1.2 and

it is NATted by the checkpoint to be

129.174.1.2. Rb ip address is 129.174.1.3

IPSec is between Ra and Rb for LanA and LanB.

Straight forward IPSec between Ra and Rb,

no GRE whatsoever.

On the checkpoint firewall, I have static

NAT for Ra from 192.168.1.2 to 129.174.1.2

and I have rule on the firewall to allow

EVERYTHING through the firewall.

On the router, I explicitly put in the

following command:

crypto ipsec nat-transparency udp-encapsulation

The VPN between Ra and Rb is working and traffic

between Ra and Rb is working; however, tcpdump

on the checkpoint firewall reveals that the routers

are using ESP (proto 50) instead of NAT-T (udp/4500).

I thought that if the VPN device detects that

it is behind a NAT device, it will use nat-t

instead of ESP. Furthermore, the command

I put into the router should be enough

to tell the routers to use udp/4500.

I asked Cisco about this before but they have an

answer for me either.