IPsec and NAT Traversal
IKE can negotiate IPsec SAs across a NAT box. This ability enables systems
to securely connect from a remote network, even when the systems are behind
a NAT device. For example, employees who work from home, or who log
on from a conference site can protect their traffic with IPsec.
NAT stands for network address translation. A NAT box is used to
translate a private internal address into a unique Internet address. NATs are very
common at public access points to the Internet, such as hotels. For a
fuller discussion, see Using Solaris IP Filter's NAT Feature.
The ability to use IKE when a NAT box is between communicating
systems is called NAT traversal, or NAT-T. In the Solaris 10 release, NAT-T
has the following limitations:
NAT-T works on IPv4 networks only.
NAT-T cannot take advantage of the IPsec ESP acceleration provided by the Sun Crypto Accelerator 4000 board. However, IKE acceleration with the Sun Crypto Accelerator 4000 board works.
The AH protocol depends on an unchanging IP header, therefore AH cannot work with NAT-T. The ESP protocol is used with NAT-T.
The NAT box does not use special processing rules. A NAT box with special IPsec processing rules might interfere with the implementation of NAT-T.
NAT-T works only when the IKE initiator is the system behind the NAT box. An IKE responder cannot be behind a NAT box unless the box has been programmed to forward IKE packets to the appropriate individual system behind the box.
The following RFCs describe NAT functionality and the limits of NAT-T. Copies of
the RFCs can be retrieved from http://www.rfc-editor.org.
RFC 3022, “Traditional IP Network Address Translator (Traditional NAT),” January 2001
RFC 3715, “IPsec-Network Address Translation (NAT) Compatibility Requirements,” March 2004
RFC 3947, “Negotiation of NAT-Traversal in the IKE,” January 2005
RFC 3948, “UDP Encapsulation of IPsec Packets,” January 2005
To use IPsec across a NAT, see Configuring IKE for Mobile Systems (Task Map).