RE: IPSec Passthrough

[Vinay K Nallamothu <vinay-rc@naturesoft.net>]

On Thu, 2003-05-01 at 23:44, BSingh@Nomadix.com wrote:
> server. It is dependent on the server implementation to distinguish 2
> different connections coming from the same IP address (of the NAT device)
> and is not a very reliable method of doing things..
what tricks were used by the NAT-T unware IPsec gateways?

Few mechanisms i could imagine the IPsec gateways did:
1. Use L2TP over IPsec and tie (using firewall rules) the PPP/L2TP
assigned IP address to the IPsec SA.

2. Do some sort of (static?) NAT (again using firewall) on the packets
coming out an SA so that the packets on the reverse path can be reliably
channeled to the correct SA.

Any better ways of doing that?

vinay