The port 450/UDP…. is used by…IP-sec NAT-T…. When a tunnel crosses a translation equipment of addresses. After the IKE negotiation usually initiated on port 500/UDP, NAT-T encapsulates IPsec traffic in UDP 4500 in order to cross the NAT; its diagnosis must therefore check IKE, the detection of NAT and the effective passage to 4500….
What is the purpose of port 4500?….
The port 450/UDP…. is used by IPsec NAT Traversal when NAT equipment is detected between peers. IKE negotiation usually starts on UDP 500 and then switches to 4500 to transport IKE and the ESP packets encapsulated in UDP. See traffic 500 without traffic 4500 in a NAT scenario can therefore guide the diagnosis….
Transport Protocol
UDP
Safety precautions
Should we open this port in the firewall?
UDP 4500 may have to be exposed on an Internet VPN gateway: this is not a port to be closed systematically. Limit peers when they are known, use robust IKE/IPsec parameters and monitor failures. However, avoid allowing NAT-T to internal devices that have no VPN role…
How do I check this port?
Capture simultaneously…udp port 500 or udp port 4500 Check both peers’ IKE logs. Check if NAT detection occurs and if translations keep sessions correctly….
- To control the initial exchange IKE on UDP 500…
- Check the NAT-T switch to UDP 4500…
- Control the NAT timeouts and rules of the path…
- Then compare IPsec proposals, identities and selectors if the tunnel remains in failure….
FAQ — port 4500 / IPsec NAT-T….
Why does IPsec use port 4500?….
When NAT is detected, NAT-T encapsulates IPsec in UDP 4500 to make it easier to cross translation equipment….
Does port 500 still have to be with 4500?
Yes in many scenarios, because IKE starts on 500 before switching to 4500 after NAT detection.
What can be done to check if 500 works but not 4500?
You can also use the NAT, UDP 4500 rules, timesouts and IKE logs on both ends.