Subject: [NAT] ipsec/NAT query

From: "Prakash Jain" <[email-masked]>
Date: Tue, 27 Nov 2001 09:11:04

Hi,
I am new to both ipsec and NAT. I am facing some problem having ipsec with
NAT. I want to know if both can work together when they are not on same box,
for example, scenario is as follows,

ipsec                         Router                                            ipsec
client ----------------box doing---------N/w cloud----- server
(A)                           NAT (B )                                      (C)

<---------------------ipsec tunnel from A to C--------------->

I think tunneling can be supported thru NAT but not very sure about ipsec (and its flavour ESP/AH) in above scenarios. I have following queries,
1. Does NAT implementation require something specific to ipsec (ipsec-nat ALG??) in
above scenario?

2. Does ipsec protocol/negotiation involve client's ipaddress in any way?

3. Can ipsec and NAT have generic compatible implemantations (say ipsec client and NAT are from different vendors)  in above scenarios?

4. Please give some relevent links on the web for above info.

I will appreciate an early reply.

Thanks and regards,

Prakash

Get your FREE download of MSN Explorer at http://explorer.msn.com

_______________________________________________
nat mailing list
[email-masked]
http://www1.ietf.org/mailman/listinfo/nat

---

From: Jeffrey lo <[email-masked]>
Date: Tue, 27 Nov 2001 13:13:13 -0800 (PST)

There were some work done on this problem in RSIP.
Refer to RFC 3102-3105.

Jeffrey 

--- Prakash Jain <[email-masked]> wrote:

<HR>
<html><div style='background-color:'><DIV>Hi,<BR>I am
new to both ipsec and NAT. I am facing some problem
having ipsec with <BR>NAT. I want to know if both can
work together when they are not on same box, <BR>for
example, scenario is as follows,</DIV>
<DIV>&nbsp;</DIV>
<DIV>ipsec&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
Router&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
&nbsp; ipsec <BR>client ----------------box
doing---------N/w cloud-----
server<BR>(A)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
NAT
(B&nbsp;)&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;
(C)</DIV>
<DIV>&lt;---------------------ipsec tunnel from A to
C---------------&gt;</DIV>
<DIV>&nbsp;</DIV>
<DIV>I think&nbsp;tunneling can be supported thru NAT
but not very sure about ipsec (and its
flavour&nbsp;ESP/AH) in above scenarios. I have
following queries,<BR>1. Does NAT implementation
require something specific to ipsec (ipsec-nat ALG??)
in <BR>above scenario? </DIV>
<DIV>2. Does ipsec protocol/negotiation involve
client's ipaddress in any way? </DIV>
<DIV>3.&nbsp;Can ipsec and NAT have generic compatible
implemantations (say ipsec client and NAT are from
different vendors)&nbsp; in above scenarios? </DIV>
<DIV>4. Please give some relevent links on the web for
above info.</DIV>
<DIV>&nbsp;</DIV>
<DIV>I will appreciate an early reply.</DIV>
<DIV>&nbsp;</DIV>
<DIV>Thanks and regards,</DIV>
<DIV>Prakash</DIV>
<DIV>&nbsp;</DIV></div><br clear=all><hr>Get your FREE
download of MSN Explorer at <a
href='http://go.msn.com/bql/hmtag_itl_EN.asp'>http://explorer.msn.com</a><br></html>

__________________________________________________
Do You Yahoo!?
Yahoo! GeoCities - quick and easy web site hosting, just $8.95/month.
http://geocities.yahoo.com/ps/info1

---

From: Jeffrey lo <[email-masked]>
Date: Tue, 27 Nov 2001 13:13:13 -0800 (PST)

Jeffrey 

<HR>