I'm trying to set up a IPSec VPN connection between a Cisco ASA and a Mikrotik router (which is behind a Fritzbox in DMZ mode). I think everything is set up correctly except for that NAT-T is missing on the Cisco.
On a Mikrotik you can enable NAT-T per peer, but on the Cisco it's globally. Does enabling NAT-T there break other active tunnels? Or is it just a detection mechanism if IPSec needs to traverse NAT / DMZ devices?
NAT Traversal performs two tasks:
If NAT-T is enabled and client is behind NAT, then NAT-T is used
no NAT exists, then Native IPsec (ESP) is used
So not gonna affect your current tunnels.
Enabling NAT-Traversal on a Cisco Router/Firewall simply enables the detection of NAT devices in path (if the other side also supports and has NAT-T enabled).
It will not change or affect other tunnels to turn it on. If they were able to build before (with NAT-T disabled), then there was no NAT device in path, and NAT-T would detect that and cause no changes to the negotiation and tunnel transport.
To learn more, I wrote about NAT-T in this post.
Although enabling nat-t is global command but you can disable NAT-T on a per VPN basis, on crypto map entry:
EX: crypto map outside_map 5 set nat-t-disable
but anyway enabling nat-t is not going to impact your other tunnels at all.
NAT-T functionality will allow the ASA to detect devices behind a NAT and will use UDP port 4500 instead of UDP 500.
The current peers that are not behind a nat device will just work as usual with UDP port 500.
