Forcing Cisco VPN client to use NAT-T

[james.davis]

Is there a way to force the VPN client to use NAT-T when the device isn't NATed but ESP is otherwise blocked?

My VPN client connects but tries to use ESP, even though IPSec over UDP is selected, after detecting that no NAT is taking place.

[andrew.prince]

James,

Nope - it's negotiated in IKE, it's an option to detect devices that do not support VPN Pass-Thru.

HTH.

[james.davis]

Thanks. Is there an option I can set on my ASA to achieve this from the other end? :-)

[andrew.prince]

Again - nope, all you can do it disable NAT-T from either using UDP or TCP or both. But then that would break it for devices who do not support VPN PassThru.

HTH.

[james.davis]

Thanks. Using Linux's 'vpnc' as the VPN client provides a "force-natt" option which does the trick so a little disappointed I can't do it with the Cisco client.

I also found references to a feature request #CSCdz58488 so I thought it may have been implemented in the current VPN client.

[andrew.prince]

When you have a bunch of very bright people in the open source community writing apps, they will just do it as it seems like a good idea.

Cisco & feature requests.....are business driven!