Subject: Re: Another NAT Traversal question

From: ravi <[email-masked]>
Date: Wed, 19 Mar 2003 12:07:42 +0530

IKEv2 is being defined fresh. Why can't we use port 500 for the purpose of
      NAT Traversal. If we make this packet also containing first four bytes after
      UDP header as 0s in case of IKE packet, then there is no need for port 4500

Regards,
Ravi

Francis Dupont wrote:

> In your previous mail you wrote:
>
>   The checksum is being fixed according to the new IP addresses in the IP
>   header and therefore you don't need the original IP address. 
>   
>=> so you give up the transport checksum ?
>
>   >From what I recall, the authors had given up on the transport mode and
>   one of them had stated on this list that only 'tunnel mode' will be
>   pushed for v2.
>   
>=> I am afraid that there is no consensus to drop the transport mode,
>so as the NAT traversal is in the charter, there is a problem to
>really solve.
>   
>Regards
>
>[email-masked]
>
>  
>

---

From: Joern Sierwald <[email-masked]>
Date: Wed, 19 Mar 2003 09:21:17 +0100

>      UDP header as 0s in case of IKE packet, then there is no need for 

Well. Routers doing NAT reassign ports. In goes src/dst 53/53, out goes
src/dst 1025/53 or something. On the return packets, the port number are
changed back. You know that.

The problem is that over 50% of all router DO NOT DO THAT if the port is 500
the keep the 500/500 mapping. Many small vendors do that. But even the
current (February) Cisco IOS does that. And there is no way to switch it
off.

If you run IKE through a NAT box, the IKE client software can't use
port 500. Using a random port >1023 works fine. But then the client
can't be responder anymore....

the port 500 is spoiled, sorry, and it has to go.

J–rn

---

From: Joern Sierwald <[email-masked]>
Date: Wed, 19 Mar 2003 09:21:17 +0100

Jrn