|
How Both IPSec Ends Perform NAT-T Detection? |
|
NAT-T detection is performed in the first phase of IKE negotiation and is completed using the first and second packets in the first phase. The vendor ID payload is added to packets. According to RFC3947, it is converted into a value in hexadecimal notation by using the hash algorithm: vendor_id=0x4a 0x13 0x1c 0x81 0x7 0x3 0x58 0x45 0x5c 0x57 0x28 0xf2 0xe 0x95 0x45 0x2f. The value is consistent in the first and second packets and is used to detect whether the peer end supports NAT-T. Run the debug cry iskamp command during negotiation. The displayed packet carries vendor_id. Use a tool to capture packets. The vendor ID is carried in IKE packets, as shown in the following figure. |
IKE packets.png (258.86 KB, Downloads: 384)
IKE packets
This site contains user submitted content, comments and opinions and is for informational purposes only. Ruijie may provide or recommend responses as a possible solution based on the information provided; every potential issue may involve several factors not detailed in the conversations captured in an electronic forum and Ruijie can therefore provide no guarantee as to the efficacy of any proposed solutions on the community forums. Ruijie disclaims any and all liability for the acts, omissions and conduct of any third parties in connection with or related to your use of the site. All postings and use of the content on this site are subject to the Ruijie Community Terms of Use.
More ways to get help: Visit Support Videos, call us via Service Hotline, Facebook or Live Chat.
©2000-2023 Ruijie Networks Co,Ltd
Level 4
