Why IPsec NAT Traversal Requires UDP

IPsec provides robust security for network communications, but standard Network Address Translation (NAT) devices often break native IPsec protocols. This article explains the architectural conflicts between IPsec and NAT, focusing on why encapsulating traffic within the User Datagram Protocol (UDP)—a technique known as NAT Traversal (NAT-T)—is necessary to successfully route encrypted IPsec traffic across translated networks.

The Core Incompatibility Between IPsec and NAT

Standard NAT devices, particularly those performing Port Address Translation (PAT), rely on Layer 4 port numbers (such as TCP and UDP ports) to multiplex multiple private IP addresses behind a single public IP address. Native IPsec relies primarily on two protocols:

Authentication Header (AH - Protocol 51): Provides authentication and integrity for the entire packet, including the outer IP header.
Encapsulating Security Payload (ESP - Protocol 50): Provides encryption, authentication, and integrity for the packet payload.

Neither AH nor ESP uses Layer 4 port numbers. Because they exist directly on top of the IP layer (Layer 3), standard PAT routers cannot assign or track port mappings for multiple outbound connections using native ESP or AH.

The Checksum and Integrity Problem

Beyond port tracking, NAT modifies packet headers by altering the source or destination IP addresses. This behavior directly conflicts with IPsec security mechanisms:

AH Packet Corruption: AH hashes the original IP header to verify that no tampering has occurred in transit. When a NAT device alters the IP address, the receiver’s hash verification fails, causing the packet to be dropped.
ESP Encrypted Checksum Mismatches: In ESP Transport Mode, upper-layer protocols like TCP calculate a checksum that includes a “pseudo-header” containing the original IP addresses. When NAT changes the IP header, the TCP checksum becomes invalid. Because the payload containing the TCP header is encrypted by ESP, the NAT device cannot update the TCP checksum. Consequently, the receiving host discards the packet upon decryption.

How UDP Enables NAT Traversal (NAT-T)

NAT Traversal solves these incompatibilities by wrapping the ESP packet inside a standard UDP header, typically using UDP port 4500 (defined in RFC 3947 and RFC 3948).

+-------------------------------------------------------+
| Outer IP Header | UDP Header (Port 4500) | ESP Header | Encrypted Payload |
+-------------------------------------------------------+

Using UDP solves the NAT routing problem in three specific ways:

Provides Standard Layer 4 Ports: The UDP header provides dedicated source and destination port fields. This allows PAT devices to create and maintain translation tables, mapping multiple IPsec tunnels to individual internal hosts.
Protects Encrypted Payloads: The NAT device only modifies the outer IP header and the wrapper UDP port fields. The inner ESP-encrypted payload and internal transport-layer checksums remain completely untouched.
Maintains Keepalive Connections: UDP encapsulation allows the IPsec endpoints to send small, periodic keepalive packets over UDP port 4500. This prevents the stateful NAT router from prematurely closing or timing out the translation mapping during periods of network inactivity.

During the initial Internet Key Exchange (IKE) phase on UDP port 500, the communicating endpoints automatically detect whether a NAT device exists along the path. If NAT is detected, both peers automatically switch the session to UDP port 4500, ensuring the tunnel remains stable and fully functional across any translated network boundaries.