FortiGate IPSec VPN User Guide - FirewallShop.com

Defining the remaining phase 1 options
Auto Key phase 1 parameters
Defining the remaining phase 1 options
NAT traversal
NAT keepalive frequency
Additional advanced phase 1 settings are available to ensure the smooth
operation of phase 1 negotiations:
• Nat-traversal—If outbound encrypted packets will be subjected to NAT, this
option determines whether the packet will be wrapped in a UDP IP header to
protect the encrypted packet from modification. See “NAT traversal” below.
• Keepalive Frequency—If outbound encrypted packets will be subjected to
NAT, this option determines how frequently empty UDP packets will be sent
through the NAT device to prevent NAT address mapping from changing
before the lifetime of a session expires. See “NAT keepalive frequency” below.
• Dead Peer Detection—This option determines whether the FortiGate unit will
detect dead IKE peers and terminate a session between the time when a VPN
connection becomes idle and the phase 1 encryption key expires. See “Dead
peer detection” on page 141.
Network Address Translation (NAT) is a way to convert private IP addresses to
publicly routable Internet addresses and vise versa. When an IP packet passes
through a NAT device, the source or destination address in the IP header is
modified. FortiGate units support NAT version 1 (encapsulate on port 500 with
non-IKE marker), version 3 (encapsulate on port 4500 with non-ESP marker), and
compatible versions.
NAT cannot be performed on IPSec packets in ESP tunnel mode because the
packets do not contain a port number. As a result, the packets cannot be
demultiplexed. To work around this problem, the FortiGate unit provides a way to
protect IPSec packet headers from NAT modifications. When the Nat-traversal
option is enabled, outbound encrypted packets are wrapped inside a UDP IP
header that contains a port number. This extra encapsulation allows NAT devices
to change the port number without modifying the IPsec packet directly.
To provide the extra layer of encapsulation on IPSec packets, the Nat-traversal
option must be enabled whenever a NAT device exists between two FortiGate
VPN peers or a FortiGate unit and a dialup client such as FortiClient. On the
receiving end, the FortiGate unit or FortiClient removes the extra layer of
encapsulation before decrypting the packet.
When a NAT device performs network address translation on a flow of packets,
the NAT device determines how long the new address will remain valid if the flow
of traffic stops (for example, the connected VPN peer may be idle). The device
may reclaim and reuse a NAT address when a connection remains idle for too
long. To work around this problem, when you enable NAT traversal, you can
specify how often the FortiGate unit should send periodic keepalive packets
through the NAT device in order to ensure that the NAT address mapping does
not change during the lifetime of a session. The keepalive interval should be
smaller than the session lifetime value used by the NAT device.
FortiGate IPSec VPN Version 3.0 User Guide
140 01-30005-0065-20070716