Support Support Downloads Knowledge Base Case Manager My Juniper Community

Knowledge Base

Search our Knowledge Base sites to find answers to your questions.

Ask All Knowledge Base Sites All Knowledge Base Sites JunosE Defect (KA)Knowledge BaseSecurity AdvisoriesTechnical BulletinsTechnotes Sign in to display secure content and recently viewed articles

How to Enable Nat-Traversal in JUNOS-ES?

0

0

Article ID: KB10178 KB Last Updated: 05 Mar 2017Version: 5.0
Summary:
How to Enable Nat-Traversal in JUNOS Enhanced Services (JUNOS-ES)?
Symptoms:

Solution:
By default nat-traversal (NAT-T) is enabled for IKE gateways.  The default NAT-T keepalive is 5 seconds.  Therefore unless explicitly showing that NAT-T was disabled in the configuration, then the IKE phase 1 will attempt to use NAT-T if a NAT device is detected in the path between two peers.

You can confim if NAT-T was NOT disabled by viewing the configuration for the IKE gateway.

From J-Web:
  1. Navigate to Configuration > Quick Configuration > VPN > IKE.
  2. Confirm that the Disable NAT-Traversal box is NOT checked.
From CLI:
  1. From operational mode, enter command:
    show configuration security ike gateway <gateway name>

  2. Confirm that there is no-nat-traversal is NOT in the configuration.

    Example:

    root@CORPORATE> show configuration security ike gateway dialup-ike
    ike-policy ike-policy1;
    dynamic {
        user-at-hostname "remote@acme.com";
        connections-limit 10;
        ike-user-type shared-ike-id;
    }
    no-nat-traversal;
    external-interface ge-0/0/3.0;
    xauth access-profile xauth-users;
Comment on this article > Affected Products Browse the Knowledge Base for more articles related to these product categories. Select a category to begin.

Getting Up and Running with Junos

Getting Up and Running with Junos Security Alerts and Vulnerabilities Product Alerts and Software Release Notices Problem Report (PR) Search Tool EOL Notices and Bulletins JTAC User Guide Customer Care User Guide Pathfinder SRX High Availability Configurator SRX VPN Configurator Training Courses and Videos End User Licence Agreement Global Search