Description

A configuration change updated Local-ID from IP → FQDN:

This triggered the following behaviour "FQDN Local-ID triggers INITIAL_CONTACT loop due to NAT-T ACK mismatch, causing continuous IPsec reconnections. Using IP Local-ID avoids this issue"


Symptoms


Cato treats FQDN identity as a new connection, sends INITIAL_CONTACT to clear old state Leads to continuous SA teardown loop




Solution

FQDN Local-ID triggers INITIAL_CONTACT loop due to NAT-T ACK mismatch, causing continuous IPsec reconnections. Using IP Local-ID avoids this issue.

1.Revert Local-ID to IP


Or reach out to Cato support with the issue of INITIAL_CONTACT handling over NAT-T.




Modification History

2026-04-22 : Article Created