IKE can negotiate IPsec SAs across a NAT box. This ability enables systems to securely connect from a remote network even when the systems are behind a NAT device. For example, employees who work from home or who log on from a conference site can protect their traffic with IPsec.
A NAT box translates a private internal address into a unique Internet address. NATs are very common at public access points to the Internet, such as hotels.
The ability to use IKE when a NAT box is between communicating systems is called "NAT traversal", or NAT-T. NAT-T has the following limitations:
The AH protocol depends on an unchanging IP header, therefore, AH cannot work with NAT-T. The ESP protocol is used with NAT-T.
The NAT box does not use special processing rules. A NAT box with special IPsec processing rules might interfere with the implementation of NAT-T.
NAT-T works only when the IKE initiator is the system behind the NAT box. An IKE responder cannot be behind a NAT box unless the box has been programmed to forward IKE packets to the appropriate individual system behind the box.
The following RFCs describe NAT functionality and the limits of NAT-T. Copies of the RFCs are available at https://www.rfc-editor.orghttps://www.rfc-editor.org.
RFC 3022, "Traditional IP Network Address Translator (Traditional NAT)," January 2001
RFC 3715, "IPsec-Network Address Translation (NAT) Compatibility Requirements," March 2004
RFC 3947, "Negotiation of NAT-Traversal in the IKE," January 2005
RFC 3948, "UDP Encapsulation of IPsec Packets," January 2005