2012年3月5日 星期一

NAT traversal and IPsec

In order for IPsec to work through a NAT, the following protocols need to be allowed through the NAT interface(s), eg. the LAN router:
or, in case of NAT-T:
  • IKE - UDP port 500
  • IPsec NAT-T - UDP port 4500
Often this is accomplished on home routers by enabling "IPsec Passthrough".
In Windows XP, NAT-T is enabled by default, but in XP with SP2, has been disabled by default for the case when the VPN server is also behind a NAT device, because of a rare and controversial security issue[1]. IPsec NAT-T patches are also available for Windows 2000, Windows NT and Windows 98.
One usage of NAT-T and IPsec is to enable opportunistic encryption between systems. NAT-T allows systems behind NATs to request and establish secure connections on demand.

沒有留言:

張貼留言

VXLAN vs VLAN

from:https://zhuanlan.zhihu.com/p/36165475 VXLAN(Virtual eXtensible Local Area Network)或許是目前最熱門的網絡虛擬化技術。 網絡虛擬化是指在一套物理網絡設備上虛擬出多個二層網絡。 VXL...