Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

IPSec used with one-to-many or dynamic NATting

Is it true that I cannot have one-to-many or dynamic NATting (on firewall), if I were to use IPSec transport/tunneled-mode AH. Otherwise, all the IPSec packets will be dropped at the remote IPSec peer, due to the fact that the changed SRC address (because of NAT) will fail the cryptographic checksum test performed on the IPSec packets ?

But, if I were to use IPSec transport/tunneled-mode ESP, I can use one-to-many or dynamic NATting (on firewall), because there is no cryptographic checksum test needed to be performed on the IPSec packets at the remote IPSec peer ?

Can you please help me to clarify the above facts ? Thanks !

1 REPLY

Re: IPSec used with one-to-many or dynamic NATting

Since there has been no response to your post, it appears to be either too complex or too rare an issue for other forum members to assist you. If you don't get a suitable response to your post, you may wish to review our resources at the online Technical Assistance Center (http://www.cisco.com/tac) or speak with a TAC engineer. You can open a TAC case online at http://www.cisco.com/tac/caseopen

If anyone else in the forum has some advice, please reply to this thread.

Thank you for posting.

92
Views
0
Helpful
1
Replies