topic Re: Disable NAT-T for a single Site to Site VPN. in General Topics

Disable NAT-T for a single Site to Site VPN.

hcampuzano — Thu, 04 Apr 2024 19:19:44 GMT

Hello, I need to disable NAT-T for a single S2S VPN, because if I disable it on the gateway object, the mobile blade does not work and remote users are affected. That means:

NAT-T enabled: Remote Users OK. - S2S VPN fails.

NAT-T disabled: Remote Users fail. - S2S VPN OK.

The VPN community settings does not allow to disable it for that particular community.

Is there something I'm missing? Thanks for the help.

Re: Disable NAT-T for a single Site to Site VPN.

Lesley — Thu, 04 Apr 2024 20:35:12 GMT

Drop UDP 4500 from the other peer IP. Only allow ESP and ike500.

NAT-t is most of the time started by the other side. In older versions Check Point only accepts and do not send.

Newer version depends on config (is global setting)

You can only as far as I know disable it on global level.

Re: Disable NAT-T for a single Site to Site VPN.

Timothy_Hall — Thu, 04 Apr 2024 21:17:30 GMT

You can't modify how NAT-T behaves at the VPN Community level, but you can do it at the object level and all this would apply for your gateways, externally managed gateways, and interoperable devices. So what you could try is modifying these GUIdbedit properties on the object representing the peer gateway on the other side of the tunnel, or you may be able to adjust these on your own gateway object without breaking RAS VPN, the last one in the list in particular. The default values for R81.20 are shown:

force_nat_t boolean false "force the GW to use NAT traversal (port 4500)"
ike_support_nat_t boolean true "Support NAT Traversal (port 4500)"
offer_nat_t_initiator boolean false "Send NAT-T VID (for Initiator GW)
offer_nat_t_responder_for_known_gw boolean true "Accept NAT_T connections from known GWs and send NAT-T vendor id (for Responder GW)"

Re: Disable NAT-T for a single Site to Site VPN.

CheckPointerXL — Tue, 16 Apr 2024 08:38:01 GMT

I think is allowed by implicit rules... if so, fw accel dos rule is needed, or also a fake nat rule it should work