I'm trying to set up a IPSec VPN connection between a Cisco ASA and a Mikrotik router (which is behind a Fritzbox in DMZ mode). I think everything is set up correctly except for that NAT-T is missing on the Cisco.

On a Mikrotik you can enable NAT-T per peer, but on the Cisco it's globally. Does enabling NAT-T there break other active tunnels? Or is it just a detection mechanism if IPSec needs to traverse NAT / DMZ devices?

  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer.
    – Ron Maupin
    Aug 9 '17 at 18:09

NAT Traversal performs two tasks:

  1. Detects if both ends support NAT-T
  2. Detects NAT devices along the transmission path (NAT-Discovery)

If NAT-T is enabled and client is behind NAT, then NAT-T is used

no NAT exists, then Native IPsec (ESP) is used

So not gonna affect your current tunnels.


Enabling NAT-Traversal on a Cisco Router/Firewall simply enables the detection of NAT devices in path (if the other side also supports and has NAT-T enabled).

It will not change or affect other tunnels to turn it on. If they were able to build before (with NAT-T disabled), then there was no NAT device in path, and NAT-T would detect that and cause no changes to the negotiation and tunnel transport.

To learn more, I wrote about NAT-T in this post.


Although enabling nat-t is global command but you can disable NAT-T on a per VPN basis, on crypto map entry:

EX: crypto map outside_map 5 set nat-t-disable

but anyway enabling nat-t is not going to impact your other tunnels at all.

NAT-T functionality will allow the ASA to detect devices behind a NAT and will use UDP port 4500 instead of UDP 500.

The current peers that are not behind a nat device will just work as usual with UDP port 500.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.