VPN - NAT Exemption

Network Address Translation (NAT) exemption, also known as NAT bypass or NAT traversal, is a feature used in VPN configurations on Cisco devices to allow VPN traffic to bypass NAT processing. This is necessary because NAT can interfere with the IPsec VPN traffic, especially since IPsec relies on the integrity of the IP headers, which NAT modifies. Here’s a detailed explanation of NAT exemption in the context of VPNs on Cisco devices:

What is NAT Exemption?

NAT exemption is a configuration that ensures certain traffic (specifically VPN traffic) is not subjected to NAT translation. By exempting VPN traffic from NAT, the original source and destination IP addresses are preserved, allowing for the proper establishment and functioning of the VPN tunnel.

Why is NAT Exemption Needed?

  1. IPsec Integrity: IPsec protocols (like ESP and AH) rely on the original IP headers to ensure data integrity and authenticity. NAT alters these headers, causing the integrity checks to fail and the VPN traffic to be dropped.
  2. Address Consistency: For VPN connections, the internal IP addresses need to be consistent and recognizable by both ends of the VPN tunnel. NAT can change these addresses, leading to misrouting or inability to establish the tunnel.
  3. Protocol Limitations: Certain protocols used in VPNs (like AH in IPsec) cannot handle NAT due to their design, which includes the original IP headers in their hash calculations.

How NAT Exemption Works on Cisco Devices

On Cisco devices, NAT exemption can be configured using Access Control Lists (ACLs) to define which traffic should be exempt from NAT. Here's how it is typically configured:

  1. Define the Traffic to be Exempt:

    • Create an ACL that matches the traffic to be exempt from NAT. This usually includes traffic between the internal network and the VPN peers.

  2. Apply the ACL to the NAT Configuration:

    • Configure the NAT rules to bypass NAT for the traffic matched by the ACL.

NAT exemption is a critical configuration in Cisco VPN setups to ensure that VPN traffic bypasses NAT processing, preserving the integrity and functionality of the VPN connection.

Links:

https://forum.networklessons.com/t/vpn-tunnel-due-to-nat-issue/48395/2?u=lagapidis

https://networklessons.com/cisco/asa-firewall/cisco-asa-nat-exemption