RE: IPSec NAT-T is not recommended for Windows Server 2003 computers that are behind network address translators
- From: "Stefaan Pouseele" <stefaan.pouseele@xxxxxxx>
- To: "'[ISAserver.org Discussion List]'" <isalist@xxxxxxxxxxxxx>
- Date: Thu, 14 Oct 2004 22:27:02 +0200
Hey guys,
I think I begin to understand what they are trying to tell us. In the listed
scenario the sequence is as follows:
Client#1 --- Internet --- NAPT --+-- Server#1
!
+-- Client#2
1. The NAT device will forward all inbound traffic to UDP 500/4500 to
server#1
2. Client#1 (initiator) setup a SA#1 with Server#1 (responder)
3. Client#2 (initiator) setup a SA#2 with Client#1 (responder)
At this point Client#1 was initiator for SA#1 and responder for SA#2.
4. SA#2 timeouts for whatever reason and *IF* Client#1 (initial the
responder) tries to setup the SA#2 again to Client#2 (initial the initiator)
packets will of course be send to Server#1 because of the single forwarding
rule in the NAPT device.
Question: is this a common scenario?
Answer: I don't think so! Therefore, I believe it is something to taken into
account only in this specific scenario. Moreover this can be solved by
implementing 1:1 NAT for those IPSec devices behind the same NAT who must be
responders.
Comments?
Stefaan
________________________________
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: donderdag 14 oktober 2004 19:10
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: IPSec NAT-T is not recommended for Windows Server
2003 computers that are behind network address translators
http://www.ISAserver.org
That's why I think the entire "rationale" is a bit fishy. NAT-T support is
there for a reason and I sort of think that the SP2 crew sort of flubbed the
dub when they made the decision to break NAT-T support on both ends.
Tom
www.isaserver.org/shinder <http://www.isaserver.org/shinder>
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7 <http://tinyurl.com/3xqb7>
MVP -- ISA Firewalls
________________________________
From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx]
Sent: Thursday, October 14, 2004 10:53 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: IPSec NAT-T is not recommended for Windows Server
2003 computers that are behind network address translators
http://www.ISAserver.org
This scenario also includes any server-published NAT-T IPSec VPN server
behind ISA.
________________________________
From: Joe Pochedley [mailto:joepochedley@xxxxxxxxx]
Sent: Thursday, October 14, 2004 07:08
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: IPSec NAT-T is not recommended for Windows Server
2003 computers that are behind network address translators
http://www.ISAserver.org
The situation Microsoft described seems so unlikely that it just doesn't
make much sense...
Why would the user at Client2 be establishing a NAT-T connection with
Client1? If the Client2 needed to establish a connection to Client1, it
would make more sense to use the already established IPSec/VPN link to
Server1... It's quite unusual for clients to be establishing NAT-T
connections between themselves in the first place...
I guess, mulling it over, I could think of a 'few' situations where this
might happen (IT consulting guy working from home who has his personal test
server set up for incoming IPSec over his cable modem and needs to connect
out to a client.... Plausable)
Joe Pochedley
A computer terminal is not some clunky old television
with a typewriter in front of it. It is an interface
where the mind and body can connect with the universe
and move bits of it about. -Douglas Adams
________________________________
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: Thursday, October 14, 2004 9:41 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: IPSec NAT-T is not recommended for Windows Server
2003 computers that are behind network address translators
http://www.ISAserver.org
Hi Jim,
Thanks!
;-)
Tom
www.isaserver.org/shinder <http://www.isaserver.org/shinder>
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7 <http://tinyurl.com/3xqb7>
MVP -- ISA Firewalls
________________________________
From: Jim Harrison [mailto:Jim@xxxxxxxxxxxx]
Sent: Thursday, October 14, 2004 8:36 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] RE: IPSec NAT-T is not recommended for Windows Server
2003 computers that are behind network address translators
http://www.ISAserver.org
I think I have some mail to send...
________________________________
From: Thomas W Shinder [mailto:tshinder@xxxxxxxxxxx]
Sent: Thu 10/14/2004 5:28 AM
To: [ISAserver.org Discussion List]
Subject: [isalist] IPSec NAT-T is not recommended for Windows Server 2003
computers that are behind network address translators
http://www.ISAserver.org
Hey guys,
What does the ISA brain trust make of this? Is this an ex post factor
apologia for a bad design decision made with XP SP2, or a valid
rationale for their decision?
IPSec NAT-T is not recommended for Windows Server 2003 computers that
are behind network address translators:
http://support.microsoft.com/default.aspx?scid=kb;en-us;885348
Tom
www.isaserver.org/shinder
Tom and Deb Shinder's Configuring ISA Server 2004
http://tinyurl.com/3xqb7
MVP -- ISA Firewalls
Other related posts:
