Watchguard V10 - NAT Traversal (UDP Encapsulation)

Internet Key Exchange (IKE)
Firebox Vclass User Guide 303
tion. Phase 2 involves an exchange of keys to determine
how the data between the two will be encrypted.
Diffie-Hellman is an algorithm used in IKE to negotiate
keys required for data encryption. Diffie-Hellman groups
are collections of parameters used to achieve the negotia-
tion. These groups allow two peer systems that have no
prior knowledge of one another to publicly exchange and
agree on a shared secret key. Group 1 is a 768-bit prime
modulus group, and group 2 is a 1024-bit prime modulus
group. The difference is in the number of bits used for
exponentiation to generate private and public keys. Group
2 is more secure than group 1, but requires more time to
compute the keys.
NAT Traversal (UDP Encapsulation)
A problem occurs with IPSec-encrypted packets crossing
NAT devices. The IPsec authentication header (AH) pro-
tects entire IP packets, including IP headers, from modifi-
cation. NAT modifies the IP header, causing an inherent
incompatibility. The IPsec Encapsulating Security Payload
(ESP) encrypts IP packets. NAT cannot modify TCP and
UDP ports when these values are encrypted. NAT is there-
fore incompatible with ESP.
The solution for this problem is UDP encapsulation, or NAT
traversal. UDP encapsulation wraps an IPsec packet inside a
UDP/IP header. This allows NAT to function, without
modifying the encapsulated IPsec packet.
Figure 12: UDP Encapsulation
Encapsulation requires “decapsulation.” ESP-wrapped
packets are exchanged between IKE peers: gateway-to-
Original
IP Header
UDP
Header
Zero
Pad
ESP
Header
TCP/UDP Original Payload ESP Trail ESP Auth
Encrypted
Authenticated