Disable NAT-T for a single Site to Site VPN.

[hcampuzano]

Hello, I need to disable NAT-T for a single S2S VPN, because if I disable it on the gateway object, the mobile blade does not work and remote users are affected. That means:

NAT-T enabled: Remote Users OK. - S2S VPN fails.

NAT-T disabled: Remote Users fail. - S2S VPN OK.

The VPN community settings does not allow to disable it for that particular community.

Is there something I'm missing? Thanks for the help.

[Lesley]

Drop UDP 4500 from the other peer IP. Only allow ESP and ike500.

NAT-t is most of the time started by the other side. In older versions Check Point only accepts and do not send.

Newer version depends on config (is global setting)

You can only as far as I know disable it on global level. 

[CheckPointerXL]

I think is allowed by implicit rules... if so, fw accel dos rule is needed, or also a fake nat rule it should work

[Timothy_Hall · Accepted solution]

You can't modify how NAT-T behaves at the VPN Community level, but you can do it at the object level and all this would apply for your gateways, externally managed gateways, and interoperable devices.  So what you could try is modifying these GUIdbedit properties on the object representing the peer gateway on the other side of the tunnel, or you may be able to adjust these on your own gateway object without breaking RAS VPN, the last one in the list in particular.   The default values for R81.20 are shown:

• force_nat_t  boolean  false  "force the GW to use NAT traversal (port 4500)"
• ike_support_nat_t  boolean  true "Support NAT Traversal (port 4500)"
• offer_nat_t_initiator   boolean  false  "Send NAT-T VID (for Initiator GW)
• offer_nat_t_responder_for_known_gw   boolean  true  "Accept NAT_T connections from known GWs and send NAT-T vendor id (for Responder GW)"