IPSec NAT pass-through and TCP checksums

[Bora Akyol <bora@cisco.com>]

>From a review of the NAT-T and UDP encap IDs, 
it seems that the entity that is within the
private network (and behind the NAT gw) does not have access to the
public side IP address of the NAT gw.

This in turn causes the receiver of transport-udp mode traffic to
recompute the entire TCP checksum as opposed to an adjustment of it.

>From the statements in the relevant sections of the ID, it seems that
this is in fact correct. I am wondering however, why not simply add a
NAT-NA (NAT Address) payload (optionally) sent by the public side
device, which has this address, to the other party involved in
the IKE exchange so that a simple recomputation should suffice. Of
course if both sides are behind NAT gws then all bets are off.

I may be opening up an old wound here unknowingly, and my apologies
for that in advance.

Regards,

Bora Akyol

ps. I did try to search the list archives on this topic 
but neither of the two FTP sites are working tonight.