Simple definition
NAT-T (NAT Traversal) allows an IPsec VPN to operate when a Network Address Translation device is located between the two peers.
Technical definition
NAT traversal is negotiated during IKE. When a NAT device is detected, IPsec ESP packets can be encapsulated in UDP so the translator can maintain session state. The commonly deployed mechanism uses UDP port 4500 after NAT detection and IKE negotiation.
What is it used for?
Keep an IPsec tunnel working when a client, firewall, or remote peer uses a private address translated by a router, broadband gateway, or other NAT device.
Practical example
A VPN client starts IKE from behind a home gateway. The peers detect NAT and switch to NAT-T, carrying encrypted ESP traffic inside UDP port 4500 so it can traverse address translation.
Common issues
- UDP port 4500 is blocked on the path
- Double NAT or CGNAT causes unexpected behavior
- NAT mapping expires too quickly
- NAT is detected on only one side or IKE negotiation is incomplete
Key takeaway: If IKE starts but IPsec traffic fails behind NAT, verify NAT-T negotiation and UDP 4500 first.