• Home |
• Products |
• Support |
• KB

IPSEC pass through is a technique for allowing IPSEC packets to pass through a NAT router. By itself, IPSEC does not work when it travels through NAT. Newer IKE and IPSEC implementations support NAT-Traversal which is a technique to detect NAT and switch to UDP encapsultion for IPSEC ESP packets. However, many router vendors have developed a "pass through" technique that allows IPSEC packets to pass through NAT without NAT-T support.

IPSEC pass through implementations can vary in the features that they support. Early implementations of IPSEC pass through only supported a single client passing through NAT. Others allow multiple connections as long as each client is using a different VPN server. More advanced implementations use cookie tracking for IKE and SPI tracking for IPSEC to support multiple connections through NAT.

CDRouter contains a few IPSEC pass through related testvars that can be used to control the testing of an IPSEC pass through implementation.

IPSEC Pass Through Options

testvar supportsIPSECpass yes

To enable IPSEC pass through testing, the testvar supportsIPSECpass must be set to yes. Otherwise, any IPSEC pass through tests will be skipped.

testvar alwaysUseIke yes

Some pass through mechanisms do not work unless IKE is used. You can enable the tests to always create an IKE session when IPSEC pass through is tested. NOTE: These types of implementations do not support manually keyed tunnels where there is no IKE.

testvar ipsecPassRetransmit yes

By default, the IPSEC pass through tests do not always retransmit multiple packets. Some pass through mechanisms always drop the first packet. You can turn on IPSEC retransmissions so that multiple IPSEC packets will be sent during the test.

testvar ipsecMaxTunnels 10

The ipsecMaxTunnels testvar controls how many IPSEC pass through sessions CDRouter will attempt to create.

testvar ipsecScaleSameServer yes

During the IPSEC scaling tests in the scaling.tcl module, CDRouter creates multiple IPSEC tunnels to different VPN servers. Each client connection uses a unique IP destination address for the VPN server. You can configure CDRouter to use the same VPN server for each IPSEC connection using the testvar ipsecScaleSameServer.

If the pass through mechanism works for other IP protocol types, you can set the testvar unknownPassthrough to "yes".

Most routers support IPSEC pass through using private addresses on the LAN interface. Normally, the ipsecAddressType should be set to 'private'. However, some routers require a DMZ type configuration where the public IP address is used on the LAN side. In these cases, the ipsecAddressType should be set to 'public'.