NAT-T in Netowork Firewall

NAT-T (NAT Traversal) in a firewall is a method that lets IPsec VPN traffic pass through devices doing Network Address Translation (NAT) without breaking.

NAT-T wraps (encapsulates) IPsec ESP packets inside UDP, making them NAT-friendly.

• ESP → encapsulated in UDP

• NAT devices are happy because it now looks like normal UDP traffic

Key ports & protocols

• UDP 500 – IKE (initial key exchange)

• UDP 4500 – IPsec with NAT-T (ESP over UDP)

• ESP (protocol 50) – still used, but inside UDP 4500 when NAT-T is active