Question

An engineer is establishing an IPsec tunnel from an on-premises Cisco IOS XE router to a cloud-hosted Cisco IOS XE router in AWS. The on-premises router sits behind a corporate firewall that performs PAT (NAT overload) for all outbound traffic. IKEv2 Phase 1 negotiation begins but the tunnel never fully establishes, and debugs show the peers detecting an address translation during negotiation. Which behavior must occur for the IPsec tunnel to establish successfully through the PAT device?

Accepted Answer

The peers must switch ESP encapsulation to UDP port 4500 after NAT is detected during IKE_SA_INIT

Answer

The peers must disable NAT detection payloads so ESP is sent natively over IP protocol 50

Answer

The PAT device must be reconfigured to forward IP protocol 50 to the on-premises router's inside address

Answer

The peers must fall back to IKEv1 aggressive mode to allow ESP traversal of the PAT device