Is it possible to setup IPsec behind NAT without port forwarding?

Question

We want to setup a IPsec connection between customer sites and our office so we can manage the hardware we place at customer sites (e.g. barriers). Its important that the VPN connection stays up all time.

We prefer to do this by placing a piece of IPsec supporting hardware (probably a router, already available in most cases) inside the customers network. The devices we need to manage for our customers will be placed behind this router. The router should setup a IPsec connection to our office.

Unfortunately we have not always control over the customers network so we are not always able to forward ports. Also not all customers are cooperative in terms of port forwarding.

Is it possible to configure IPsec so that it can operate without port forwarding at the customer side? (like OpenVPN does for example)

At our office we are using pfSense as IPsec server, at the customer site are in many cases already Edgerouter X devices available. In new installation we can also use other hardware even when i think that the solution is more in the configuration of IPsec when its even possible.

Network sketch:

Answer 1

Yes, that is possible. You need to use NAT traversal mode (NAT-T), and the connection can only be initiated by the device behind NAT (ie. the connection must be made towards the node reachable from the public network). Note that NAT-T uses UDP port 4500 instead of 500 to connect.