RFC 3715 - IPsec-Network Address Translation (NAT) Compatibility Requirements

Document Information

• RFC Number: 3715
• Title: IPsec-Network Address Translation (NAT) Compatibility Requirements
• Authors: B. Aboba, W. Dixon (Microsoft)
• Date: March 2004
• Category: Informational
• Status: Informational

Abstract

This document describes known incompatibilities between Network Address Translation (NAT) and IPsec, and describes the requirements for addressing them. Perhaps the most common use of IPsec is in providing virtual private networking capabilities. One very popular use of Virtual Private Networks (VPNs) is to provide telecommuter access to the corporate Intranet. Today, NATs are widely deployed in home gateways, as well as in other locations likely to be used by telecommuters, such as hotels. The result is that IPsec-NAT incompatibilities have become a major barrier in the deployment of IPsec in one of its principal uses.

Contents

• 1. Introduction
  • 1.1. Requirements Language
• 2. Known Incompatibilities between NA(P)T and IPsec
  • 2.1. Intrinsic NA(P)T Issues
  • 2.2. NA(P)T Implementation Weaknesses
  • 2.3. Helper Incompatibilities
• 3. Requirements for IPsec-NAT Compatibility
• 4. Existing Solutions
  • 4.1. IPsec Tunnel Mode
  • 4.2. RSIP
  • 4.3. 6to4
• 5. Security Considerations
• 6. References
  • 6.1. Normative References
  • 6.2. Informative References
• 7. Acknowledgements
• 8. Authors' Addresses
• 9. Full Copyright Statement