Lecture 102: VPN NAT Traversal (NAT-T)
- 课程：[NEW] AWS Certified Advanced Networking Specialty 2026
- 视频时长：05:16
- 来源：Udemy Lecture 26077674
- Slide 数量：3
- 画面切换：00:15、03:40
扫描说明
逐条检查了 Udemy 页面中的 69 条 Transcript cue，并以每条 cue 对应画面为时间轴逐段扫描全长约 5:16 的视频。依据标题、NAT-T 工作机制与端口示意、配置与考试要点三个独立画面阶段，共划分出 3 个小节。
Transcript 来自 Udemy 页面自带的英文自动字幕，没有使用 ASR。下面保留页面原文，包括其中的语法或识别错误。
1. NAT Traversal 的作用
时间范围：00:00–00:15
总结 / Summary
中文
NAT 穿越（NAT Traversal, NAT-T）用于让位于网络地址转换设备（Network Address Translation, NAT）之后的客户网关（Customer Gateway, CGW）仍能建立和传输 IPsec VPN。其核心方法是把封装安全载荷（Encapsulating Security Payload, ESP）再封装进用户数据报协议（User Datagram Protocol, UDP），避免 NAT 修改 IP 头后破坏 ESP 完整性校验。
English
NAT Traversal allows a Customer Gateway behind a Network Address Translation device to establish and carry an IPsec VPN. It works by encapsulating ESP inside UDP so that address translation does not invalidate ESP integrity checks after modifying the IP header.
Transcript
00:00 All right.
00:00 The another important feature that you should know about AWS site to Site VPN is the Nat traversal,
00:07 also written as Nat T.
00:10 Okay.
00:10 So in this lecture let's understand more about Nat traversal okay.
2. UDP 500、ESP 50 与 UDP 4500
时间范围：00:15–03:40
总结 / Summary
中文
客户网关（CGW）可公网直达且不经过 NAT 时，Internet Key Exchange 协商（IKE negotiation）使用入站和出站 UDP 500，实际 IPsec 数据使用 ESP 协议号 50；ESP 50 是 IP 协议号而不是端口。客户网关位于 NAT 后时，NAT 会改写 IP 头并导致 ESP 完整性检查失败，因此必须在客户网关上启用 NAT-T，把 ESP 封装到 UDP 4500 中，同时放行双向 UDP 500 和 UDP 4500。AWS 会在 IKE 协商期间自动检测 NAT 并切换到 UDP 4500，AWS 侧无需额外配置。
English
When the Customer Gateway is publicly reachable without NAT, IKE negotiation uses inbound and outbound UDP 500, while IPsec data uses ESP IP protocol 50; ESP 50 is a protocol number, not a port. Behind NAT, rewriting the IP header breaks ESP integrity checking, so NAT-T must be enabled on the Customer Gateway to encapsulate ESP in UDP 4500, with bidirectional UDP 500 and UDP 4500 permitted. AWS detects NAT during IKE negotiation and switches automatically, requiring no additional AWS-side configuration.
Transcript
00:15 So this is a typical architecture as you can see here.
00:19 And important thing to note is that the customer gateway where we are terminating the VPN is publicly
00:26 accessible.
00:27 So you are creating the VPN tunnel between the virtual Private gateway or the Transit gateway and the
00:33 customer gateway, which is publicly accessible.
00:37 So in this normal case, in order to have the IK handshake, you need to have UDP port 500 open at this
00:45 customer gateway.
00:46 And that is inbound and outbound port.
00:49 So this is for Ike negotiation.
00:51 But for actually sending the traffic through this IPsec tunnel.
00:55 It uses ESP 50 protocol.
00:58 And the ESP is encapsulating security payload.
01:02 And 50 is a protocol ID, for example TCP protocol six.
01:07 Likewise, it's a protocol, and for ESP there are no ports.
01:12 But you have to open the particular protocol in your firewall if it is there for this customer gateway.
01:18 So in the regular case, if your customer gateway is publicly accessible, then you must allow inbound
01:25 and outbound traffic for this two protocols and the ports UDP with 500 ports and ESP 50 protocol.
01:35 So that's a normal case.
01:38 And now let's look at the scenario when your customer gateway is behind the Nat device.
01:44 Right.
01:45 So something like this.
01:47 Now if this is the case basically Nat device cannot handle the ESP 50 protocol.
01:54 And that's because ESP handles your encryption authentication and integrity of the packet.
02:00 Now you know that Nat basically accesses the IP header replaces the source IP with its own IP, and
02:08 if you do that at this moment, then ESP integrity check will fail.
02:13 And that's where you cannot directly use the ESP 50 protocol here.
02:17 Right now you have to encapsulate this ESP 50 inside the UDP header.
02:24 So in order to support the customer gateway behind the Nat, you have to do a couple of things.
02:29 First you have to enable the Nat traversal that is Nat T on your customer gateway device.
02:37 And second on your firewall or on the Nat device.
02:40 You have to allow UDP traffic on port 4500.
02:47 And once you do that on AWS side, you don't have to do anything because during the initial handshake,
02:53 AWS understands that it is talking to the Nat device.
02:57 And it all happens as a part of Ike negotiation.
03:00 And then AWS will start wrapping up this ESP 50 inside the UDP packet, and it will send request over
03:09 port 4500 and later that will handle the UDP packets and will send the packets to the customer gateway
03:17 where you can terminate the VPN.
03:20 So whenever customer gateway is behind the Nat, then you have to enable the Nat traversal and you have
03:27 to open these ports.
03:29 So in this case, as I said, you have to allow inbound and outbound traffic for both this UDP ports.
03:36 Okay.
03:36 So I hope it is clear.
03:37 Now with that let's just summarize what we discussed.
3. NAT-T 配置要点与 Accelerated VPN
时间范围：03:40–05:16
总结 / Summary
中文
防火墙规则取决于是否经过 NAT：不使用 NAT 时放行双向 UDP 500 与 ESP 协议 50；使用 NAT 时放行双向 UDP 500 与 UDP 4500。NAT-T 只需在客户网关（CGW）侧启用，AWS 会自动完成检测与切换。加速站点到站点 VPN（Accelerated Site-to-Site VPN）必须启用 NAT-T，因为 AWS Global Accelerator 不直接支持 ESP 协议 50 流量。
English
Firewall rules depend on whether NAT is present: without NAT, allow bidirectional UDP 500 and ESP protocol 50; with NAT, allow bidirectional UDP 500 and UDP 4500. NAT-T is enabled on the Customer Gateway, while AWS detects and switches automatically. Accelerated Site-to-Site VPN requires NAT-T because AWS Global Accelerator does not directly support ESP protocol 50 traffic.
Transcript
03:40 So AWS automatically detects the Nat during key negotiation and switches to UDP for 500 instead of directly
03:48 sending traffic using ESP 50 protocol.
03:52 So for Nat traversal, no configuration is required on AWS side, but on the customer gateway side.
03:59 If you are not using Nat, then you must allow inbound and outbound for UDP 500 and ESP 50 protocol.
04:07 But if your customer gateway is behind the net, then you must allow inbound and outbound traffic on
04:14 UDP port 500 and UDP port 4500.
04:19 Right.
04:19 So that's basically is Nat traversal where your customer gateway is behind the Nat.
04:23 And from the previous lecture just I want to bring up one topic.
04:27 You know that when you enable the accelerated VPN using AWS Global Accelerator, you have to enable
04:35 the Nat traversal on the customer gateway device.
04:38 And that's for the reason that AWS Global Accelerator doesn't support the ESP 50 traffic.
04:44 So you have to send the traffic inside the UDP packet.
04:48 And that's where Nat traversal has to be enabled on the customer gateway side.
04:54 Right.
04:55 So I hope it is clear what is Nat traversal and what configurations you need on the customer gateway
05:00 side.
05:01 So I hope you will remember that because in your exam, there might be one question around this Nat
05:06 traversal, and I am sure you can now answer that.
05:10 So with that, let's stop for this lecture and let's go to the next lecture.
05:14 Thank you.
整讲总结 / Overall Summary
中文
NAT 穿越（NAT-T）通过 UDP 4500 封装 ESP，使 IPsec VPN 能穿越会改写 IP 头的 NAT 设备。IKE 协商（IKE negotiation）从 UDP 500 开始，AWS 自动检测 NAT 并切换传输方式；客户侧应根据是否存在 NAT，分别放行 UDP 500 + ESP 50 或 UDP 500 + UDP 4500。加速站点到站点 VPN（Accelerated Site-to-Site VPN）必须使用 NAT-T。
English
NAT Traversal carries ESP inside UDP 4500 so an IPsec VPN can cross a NAT device that rewrites IP headers. IKE begins on UDP 500, and AWS automatically detects NAT and switches transport. Customer-side firewall rules should allow UDP 500 plus ESP 50 without NAT, or UDP 500 plus UDP 4500 with NAT. Accelerated Site-to-Site VPN requires NAT-T.
返回顶部 ↑