Resolving Connectivity Issues

IPsec NAT-Traversal

NAT-T (NAT traversal or UDP encapsulation) makes sure that IPsec VPNClosed Check Point Software Blade on a Security Gateway that provides a Site to Site VPN and Remote Access VPN access. connections stay open when traffic goes through Security Gateways or devices that use NAT.

When an IP packet passes through a network address translator device, it is changed in a way that is not compatible with IPsec. To protect the original IPsec encoded packet, NAT traversal encapsulates it with an additional layer of UDP and IP headers.

For IPsec to work with NAT traversal, these protocols must be allowed through the NAT interface(s):

  • IKE - UDP port 500

  • IPsec NAT-T - UDP port 4500

  • Encapsulating Security Payload (ESP) - IP protocol number 50

  • Authentication Header (AH) - IP protocol number 51

Configuring NAT-Traversal

To configure NAT-T for Site to Site VPN:

  1. In SmartConsoleClosed Check Point GUI application used to manage a Check Point environment - configure Security Policies, configure devices, monitor products and events, install updates, and so on., from the left navigation panel, click Gateways & Servers.

  2. Open the applicable Security GatewayClosed Dedicated Check Point server that runs Check Point software to inspect traffic and enforce Security Policies for connected network resources. object with enabled IPsec VPN Software BladeClosed Specific security solution (module): (1) On a Security Gateway, each Software Blade inspects specific characteristics of the traffic (2) On a Management Server, each Software Blade enables different management capabilities..

  3. From the left tree, click IPsec VPN > VPN Advanced.

  4. Make sure to select Support NAT traversal (applies to Remote Access and Site to Site connections).

    NAT-Traversal is enabled by default when a NAT device is detected.

  5. Click OK.

  6. Install the Access Control Policy.

Advanced NAT-T Configuration

These variables are defined for each Security Gateway and control NAT-T for Site to Site VPNClosed An encrypted tunnel between two or more Security Gateways. Synonym: Site-to-Site VPN. Contractions: S2S VPN, S-to-S VPN.:

Item

Description

Default Value

offer_nat_t_initator

Initiator sends NAT-T traffic

false

offer_nat_t_responder_for_known_gw

Responder accepts NAT-T traffic from known Security Gateways

true

force_nat_t

Force NAT-T, even if there is no NAT-T device

false

The variables can be viewed and changed in Database Tool (GuiDBEdit Tool) (see sk13009):

  1. In the top left pane, click TABLE > Network Objects > network_objects.

  2. In the top right pane, select the applicable Security Gateway object.

  3. In the bottom pane, see the VPN section.

  4. Save the changes: click File menu > Save All.

  5. In SmartConsole, install the Access Control Policy on this Security Gateway object.