IPSec NAT pass-through: how the server side distinguish different client?

[Feng Ye <f_ye@yahoo.com>]

Hello,

I have implemented IPSec NAT pass through in the
access box by looking at cookie/SPI values. I can
sucessfully do the 1 to 1 and 1 to many cases, but
can't do the many to 1 case, because I don't know how
to configure the public side VPN server. 
That server don't know how to distinguish different
clients behind the NAT, because they all have the same
tunnel endpoint IP address (the NAT public address),
and they all use ESP, and the same
encrypt/authenticate algorithm. So to the server, all
of them belongs to the same SA. Captured packets in
the server side shows that even different clients use
different SPI to talk to the server, the server
responses with the same SPI, thus caused the problem.
I tested with cisco 2600 and win2000 as the VPN
server, all has the same problem.
Is anybody there can give me a clue? Thanks a lot!

feng


__________________________________________________
Do You Yahoo!?
Yahoo! Finance - Get real-time stock quotes
http://finance.yahoo.com