Cisco ASA Series Cli Configuration Manual page 1564

Configuring ISAKMP
For example, the following command sets the peer identification method to hostname:
hostname(config)# crypto isakmp identity hostname
Enabling IPsec over NAT-T
NAT-T lets IPsec peers establish a connection through a NAT device. It does this by encapsulating IPsec
traffic in UDP datagrams, using port 4500, which provides NAT devices with port information. NAT-T
auto-detects any NAT devices and only encapsulates IPsec traffic when necessary. This feature is
disabled by default.
Note
Due to a limitation of the AnyConnect client, you must enable NAT-T for the AnyConnect client to
successfully connect using IKEv2. This requirement applies even if the client is not behind a NAT-T
device.
With the exception of the home zone on the Cisco ASA 5505, the ASA can simultaneously support
standard IPsec, IPsec over TCP, NAT-T, and IPsec over UDP, depending on the client with which it is
exchanging data.
The following breakdown shows the connections with each option enabled.
Options
Option 1
Option 2
Option 3
Note
When IPsec over TCP is enabled, it takes precedence over all other connection methods.
When you enable NAT-T, the ASA automatically opens port 4500 on all IPsec-enabled interfaces.
The ASA supports multiple IPsec peers behind a single NAT/PAT device operating in one of the
following networks, but not both:
•
•
In a mixed environment, the remote access tunnels fail the negotiation because all peers appear to be
coming from the same public IP address, address of the NAT device. Also, remote access tunnels fail in
a mixed environment because they often use the same name as the LAN-to-LAN tunnel group (that is,
the IP address of the NAT device). This match can cause negotiation failures among multiple peers in a
mixed LAN-to-LAN and remote access network of peers behind the NAT device.
Cisco ASA Series CLI Configuration Guide
1-14
Enabled Feature
If NAT-T is enabled
If IPsec over UDP is enabled
If both NAT-T and
IPsec over UDP are enabled
LAN-to-LAN
Remote access
Chapter 1
Client Position
and client is behind NAT, then NAT-T is used
and no NAT exists, then
and client is behind NAT, then IPsec over UDP is used
and no NAT exists, then
and client is behind NAT, then NAT-T is used
and no NAT exists, then
Configuring IPsec and ISAKMP
Feature Used
Native IPsec (ESP) is used
IPsec over UDP is used
IPsec over UDP is used