Juniper IP SERVICES - CONFIGURATION GUIDE V 11.1.X, Configuration Manual

Page: 319 / 366

For information about configuring NAT passthrough mode as part of an IPSec transport
profile, see “Configuring IPSec Transport Profiles” on page 302
.
NAT Traversal
Using NAT passthrough mode is an adequate solution when a single remote user
located behind a NAT device needs secure access to an E Series router. However,
NAT passthrough mode does not support secure access to the router by multiple
remote users at locations such as hotels or airports where a NAT device resides
between the router and the remote users. In addition, NAT passthrough mode does
not provide secure access for groups of remote users at corporate locations where
a NAT device resides between the company's intranet and the public IP network.
To allow secure router access for multiple remote hosts located behind a NAT device,
the router supports a set of IETF standards collectively known as NAT Traversal
(NAT-T). For a list of the individual standards that NAT-T comprises, see “References”
on page 288
.
How NAT-T Works
By default, NAT-T is enabled on every virtual router configured on the system. With
NAT-T enabled, IPSec traffic flows transparently through a NAT device, thereby
allowing one or more remote hosts located behind the NAT device to use secure
L2TP/IPSec tunnel connections to access the router.
After NAT-T is enabled on a specific virtual router, either by default or by using the
ipsec option nat-t command, the router performs the following actions, in this order:
1.
The router monitors the exchange of private vendor ID (VID) payloads between
the client PC and the E Series router during the IKE SA negotiation to determine
whether both sides of the negotiation support NAT-T.
2.
If both sides of the negotiation support NAT-T, the router detects whether a NAT
device resides between the IPSec remote peers.
3.
If a NAT device is detected between the remote peers, the router negotiates the
appropriate type of UDP encapsulation as part of the IKE SA and uses this
encapsulation method to process the IPSec traffic.
The ipsec option nat-t command affects only those IKE SAs negotiated on the virtual
router after the command is issued. The command has no effect on IKE SAs that
were previously negotiated.
UDP Encapsulation
As part of the IKE SA negotiation process, the router automatically negotiates UDP
encapsulation for L2TP/IPSec control and data frames
.
When NAT-T is enabled, L2TP/IPSec control frames and data frames are wrapped in
an additional NAT-T UDP header that enables data to flow transparently through the
NAT device. The NAT device can translate the IP address of the source port associated
with the NAT-T UDP header, whereas the IPSec ESP header does not have a source
port that the NAT device can translate.
L2TP/IPSec Tunnels
■ 293
Chapter 12: Securing L2TP and IP Tunnels with IPSec