Hello. I’d like to ask if it would be possible to add an option to disable NAT-T floating to port UDP 4500. I fully understand the reasons behind automatic NAT discovery and moving to UDP 4500 once a NAT is detected, or even forcing this behavior in config.
NAT-T Keepalives¶ strongSwan starts sending keepalive packets if it is behind a NAT to keep the mappings in the NAT device intact. The interval for these small packets (a single 0xff byte after the UDP header) may be configured with the charon.keep_alive strongswan .conf option (set to 0 to disable sending keepalives, …
The underlying keying daemon used in 2.2x and newer, strongswan , doesn’t have an option to completely disable NAT-T. Leaving it to auto is best. There’s no need to disable it. 1 Reply Last reply Reply Quote 0, The location in which strongswan .conf is looked for can be overwritten at start time of the process using libstrongswan by setting the STRONGSWAN _CONF environmental variable to the desired location. … (0 to disable ). This is only useful if a clock is used that includes time spent suspended … charon.port_nat_t : 4500, –enable-socket-win — disable -socket-default to the ./configure options. The plugin is available since 5.2.0. Behavior¶ The plugin opens two IPv4/IPv6 dual protocol sockets for both IKE ports 500 and 4500. Custom ports can be specified using the charon-svc.port and charon-svc.port_nat_t strongswan .conf options.
VTI Tunnel Interface with strongSwan :: Endre Szabo, How Does NAT-T work with IPSec? – Cisco Community, Openswan, OpenVPN, Signal, OpenSSH, OpenSSL
