Table 15-1 Vpn And Nat - ZyXEL Communications Prestige 652H series User Manual

match. The VPN device at the receiving end doesn't know about the NAT in the middle, so it assumes that
the data has been maliciously altered.
IPSec using ESP in Tunnel mode encapsulates the entire original packet (including headers) in a new IP
packet. The new IP packet's source address is the outbound address of the sending VPN gateway, and its
destination address is the inbound address of the VPN device at the receiving end. When using ESP protocol
with authentication, the packet contents (in this case, the entire original packet) are encrypted. The encrypted
contents, but not the new headers, are signed with a hash value appended to the packet.
Tunnel mode ESP with authentication is compatible with NAT because integrity checks are performed over
the combination of the "original header plus original payload," which is unchanged by a NAT device.
Transport mode ESP with authentication is not compatible with NAT, although NAT traversal provides a
way to use Transport mode ESP when there is a NAT router between the IPSec endpoints (see section 16.7
for details).
Introduction to IPSec

Table 15-1 VPN and NAT

SECURITY PROTOCOL
AH
AH
ESP
ESP
Prestige 652H/HW Series User's Guide
MODE NAT
Transport N
Tunnel N
Transport N
Tunnel Y
15-5