Cisco 5510 - ASA SSL / IPsec VPN Edition User Manual

1-14
Cisco ASA Series CLI Configuration Guide
Chapter 1 Configuring IPsec and ISAKMP
Configuring ISAKMP
For example, the following command sets the peer identification method to hostname:
hostname(config)# crypto isakmp identity hostname
Enabling IPsec over NAT-T
NAT-T lets IPsec peers establish a connection through a NAT device. It does this by encapsulating IPsec
traffic in UDP datagrams, using port 4500, which provides NAT devices with port information. NAT-T
auto-detects any NAT devices and only encapsulates IPsec traffic when necessary. This feature is
disabled by default.
Note Due to a limitation of the AnyConnect client, you must enable NAT-T for the AnyConnect client to
successfully connect using IKEv2. This requirement applies even if the client is not behind a NAT-T
device.
With the exception of the home zone on the Cisco ASA 5505, the ASA can simultaneously support
standard IPsec, IPsec over TCP, NAT-T, and IPsec over UDP, depending on the client with which it is
exchanging data.
The following breakdown shows the connections with each option enabled.
Note When IPsec over TCP is enabled, it takes precedence over all other connection methods.
When you enable NAT-T, the ASA automatically opens port 4500 on all IPsec-enabled interfaces.
The ASA supports multiple IPsec peers behind a single NAT/PAT device operating in one of the
following networks, but not both:
• LAN-to-LAN
• Remote access
In a mixed environment, the remote access tunnels fail the negotiation because all peers appear to be
coming from the same public IP address, address of the NAT device. Also, remote access tunnels fail in
a mixed environment because they often use the same name as the LAN-to-LAN tunnel group (that is,
the IP address of the NAT device). This match can cause negotiation failures among multiple peers in a
mixed LAN-to-LAN and remote access network of peers behind the NAT device.
Options Enabled Feature Client Position Feature Used
Option 1 If NAT-T is enabled
and client is behind NAT, then NAT-T is used
and no NAT exists, then Native IPsec (ESP) is used
Option 2 If IPsec over UDP is enabled
and client is behind NAT, then IPsec over UDP is used
and no NAT exists, then IPsec over UDP is used
Option 3
If both NAT-T and
IPsec over UDP are enabled
and client is behind NAT, then NAT-T is used
and no NAT exists, then IPsec over UDP is used

Cisco 5510 - ASA SSL / IPsec VPN Edition Specifications

General

Brand	Cisco
Model	5510 - ASA SSL / IPsec VPN Edition
Category	Firewall
Language	English