Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

NAT-T over PIX506 ver6.31

This is a VPN client to PIX connection, i have this connection without NAT-T, and it's connecting without any problem. VPN Client 3.5.2 and PIX506 ver 6.22

Today, i upgrade PIX ver 6.22 to 6.31 for NAT-T conneciton. VPN client is only behind a PAT router. I'm able to create the connection, but no packet is passing thorough this tunnel.

All i did is upgrading the PIX to 6.31, are there any configuration changes i need to make for this NAT-T connection working. Any suggestion or idea would be appreciate.

Thanks in advance



Re: NAT-T over PIX506 ver6.31


make sure that every device in between (PAT device on client side, and broder router on pix side) doesn't block UDP4500 packets.

Make sure that you re negotiating NAT-T, by checking the Tunnel Port value, and client required is 3.6 or later for it to work.



New Member

Re: NAT-T over PIX506 ver6.31

Hi Afaq

Thanks for your reply, between the VPN client and the pix, there is only a pat router, which are sitting on the same segment with the pix. so, udp4500 should be open.

The other thing is, if i use client 3.6.3, it seems like i'm running into that AES bug, when i look at the log, it just keep saying "atts not acceptable". Anyway, i can still connect, but none of the traffic able to pass through it.

All i can see is encrypt packet at client side, no decrypt at all over PIX side.

any idea?

look forward for your reply.

Cisco Employee

Re: NAT-T over PIX506 ver6.31

NAT-T is disabled by default in 6.3 code. To enable it, use the command:

> isakmp nat-traversal

See for further details.

New Member

Re: NAT-T over PIX506 ver6.31

Thank you so much for your reply.

I just finished test it with my PIX, it runs perfectly, I really appreciate your help.

If you don't mind, can i just ask one more question, same issue, but on Router instead of PIX.

Does a router needs the same command inorder for this NAT-T to work? i have look for it, but can't find anything close. And this router is running IOS ver 12.2(13)T. Which should work according cisco documentation. I have already set this up and test, but not any luck with the connection. Any clue?

Cisco Employee

Re: NAT-T over PIX506 ver6.31

NAT-T was supposedly implemented in 12.2(13)T, can't say I've tested it specifically, but I haven't heard that it doesn't work either :-)

Here's the command reference, doesn't seem to be anything you need to do:

The NAT keepalive command is probably needed, since most other devices will send them by default I believe.

New Member

Re: NAT-T over PIX506 ver6.31

I am having the same problem. I have isakmp nat-traversal in the configuration and it still does not work for me.

Any help would be appreciated.