Allied Telesis AlliedWare AR440S - Manual (Page 4)

Page 4 | AlliedWare™ OS How To Note: VPNs for Corporate Networks
Background: NAT-T and policies
NAT-T NAT Traversal (NAT-T) can be enabled on any of our IPsec VPN links. It automatically allows
IPsec VPNs to traverse any NAT gateways that may be in the VPN path. This is likely to occur
with the VPNs from the roaming VPN clients—they are likely to use a LAN at a remote site
that is behind a NAT gateway.
NAT-T may also be applicable for a site-to-site VPN, if one of the routers is behind a NAT
gateway, such as some ADSL devices. Note that AR44xS series routers provide an ADSL
interface, which removes the need for a separate ADSL device. Therefore, the examples in
this How To Note do not include NAT-T for the site-to-site VPNs.
The following figure shows how the addresses in the IPsec headers change as a packet from a
roaming client traverses NAT gateways in the VPN pathway. The figure illustrates IPsec
transport mode with L2TP.
NAT gateway
Dest Addr
IP
PPP
L2TP
IPsec
IP
ETH
Source Addr
192.168.143.1
N/A
N/A
N/A
192.168.200.1
192.168.140.27
N/A
N/A
N/A
200.200.200.1
N/A N/A
Encrypted
192.168.200.1
roaming VPN
client
192.168.200.254
211.211.211.1
hotel
Dest Addr
IP
PPP
L2TP
IPsec
IP
ETH
Source Addr
192.168.143.1
N/A
N/A
N/A
211.211.211.1
192.168.140.27
N/A
N/A
N/A
200.200.200.1
N/A N/A
Encrypted
Internet
headquarters
VPN access
concentrator
Dest Addr
IP
ETH
Source Addr
192.168.143.1
N/A
192.168.140.27
N/A
200.200.200.1
192.168.140.254
192.168.140.27
hotel
headquarters
vpn-nat-t.eps