Nat Traversal; Figure 69 Nat Router Between Vpn Switches - Nortel BSR222 Configuration

office rules. See the VPN Branch Office Rule Setup screen
page
automatically renegotiates any nailed up tunnels. In effect, the IPSec tunnel
becomes an "always on" connection after you initiate it. Also different from keep
alive, the peer VPN switch does not have to have a Business Secure Router
compatible nailed up feature enabled in order for this feature to work.
If the Business Secure Router has its maximum number of simultaneous IPSec
tunnels connected to it and they all have nailed up enabled, no other tunnels can
take a turn connecting to the Business Secure Router because the Business Secure
Router does not drop the tunnels that are already connected (unless there is
outbound traffic with no inbound traffic).

NAT Traversal

NAT traversal allows you to set up a VPN connection when there are NAT routers
between the Nortel Business Secure Router 222 and the remote VPN switch.

Figure 69 NAT router between VPN switches

Normally, you cannot set up a VPN connection with a NAT router between the
two VPN switches because the NAT router changes the header of the IPSec
packet. In the previous figure, VPN switch A sends an IPSec packet in an attempt
to initiate a VPN. The NAT router changes the IPSec packet's header so it does
not match the header for which VPN switch B is checking. Therefore, VPN switch
B does not respond and the VPN connection cannot be built.
223). Unlike keep alive, any time the Business Secure Router restarts, it also
Note: No matter whether or not nailed up is set, when there is outbound
traffic with no inbound traffic, the Business Secure Router automatically
drops the tunnel after two minutes.
Nortel Business Secure Router 222 Configuration — Basics
Chapter 13 VPN 215
(Figure 72 on