SRX

last person joined: 4 days ago 

Ask questions and share experiences about the SRX Series, vSRX, and cSRX.

  • 1.  NAT keepalive

    Posted 07-24-2017 01:33

    what is the use of NAT keep-alive in IPSEC VPN ??

    i have searched and it said that it maintain the NAT translation between 2 peers but i dont understand what doesn that means



  • 2.  RE: NAT keepalive
    Best Answer

     
    Posted 07-24-2017 14:51

    If NAT device is detected between VPN peers NAT-T is used and all IPsec packets are encapsulated with additional UDP header. If the VPN is idle the NAT device may clear the translation. For example SRX will clear idle UDP connections after 60s. When new traffic is generated NAT device will establish different translation will different IP/port. This will break the VPN.

     

    For  more details look for "keepalive" in the following RFC's

    https://datatracker.ietf.org/doc/rfc3947/?include_text=1

    https://datatracker.ietf.org/doc/rfc3948/?include_text=1

     

    Regards, Wojtek



  • 3.  RE: NAT keepalive

    Posted 07-25-2017 02:39

    Some additional information
    "NAT keepalives are enabled to keep the dynamic NAT mapping alive during a connection between two peers. NAT keepalives are UDP packets with an unencrypted payload of 1 byte. Although the current dead peer detection (DPD) implementation is similar to NAT keepalives, there is a slight difference: DPD is used to detect peer status, while NAT keepalives are sent if the IPsec entity did not send or receive the packet at a specified period of time--valid range is between 5 to 3600 seconds."