Description

This article describes the issue of the ALG for IKE and ESP not being applied to the traffic.

Symptoms

  • A SRX device works as a NAT device, when placed between VPN clients on the private side of the NAT gateway and the VPN gateways on the public side.
  • The VPN client/server does not support NAT-T. Only the UDP port 500 will be used for establishing the VPN tunnel.
  • Customer enables IKE ESP ALG by set security alg ike-esp-nat enable ; but the VPN tunnel still fails to establish.
  • In flow traceoption, there is no application 54 attached; which means IKE ESP ALG does not work.

Solution


In order to enable IKE-ESP-NAT ALG, the matching security policy must contain the application which will trigger this ALG. If " application any " is not used as matching criteria in the security policy, then a custom application needs to be defined and used which explicitly has the IKE-ESP-NAT ALG attached.

The following example can be used to create custom applications and to attach it to the proper security policy.

set applications application custom-ike-alg source-port 500 destination-port 500 protocol udp application-protocol ike-esp-nat

Normally, you will want to make SRX support both NAT-T-capable and non-capable clients. If there are NAT-T capable clients, the user must enable the source NAT address persistence. This instructs the SRX device to use the same NAT-generated IP address for all sessions coming from the same client IP address ( address-persistent NAT ). This way, both the sessions on udp port 500 and udp port 4500 will use the same nat IP address from the source nat pool, which is required.

As a result of using the IKE-ESP-NAT ALG, the device will be able to associate a client's outgoing IKE and ESP traffic with its return traffic from the server. So, add the following commands and attach the application custom-ike-natt with the proper security policy.
set security nat source address-persistent
set applications application custom-ike-natt protocol udp source-port 4500 destination-port 4500

Here is a complete configuration example.
set security zones security-zone green address-book address sa1 1.1.1.0/24
set security zones security-zone red address-book address da1 2.2.2.0/24

set security nat source pool pool1 address 10.10.10.1/32 to 10.10.10.10/32
set security nat source rule-set rs1 from zone green
set security nat source rule-set rs1 to zone red
set security nat source rule-set rs1 rule r1 match source-address 1.1.1.0/24
set security nat source rule-set rs1 rule r1 match destination-address 2.2.2.0/24
set security nat source rule-set rs1 rule r1 then source-nat pool pool1
set security nat source address-persistent

set applications application custom-ike-alg source-port 500 destination-port 500 protocol udp application-protocol ike-esp-nat
set applications application custom-ike-natt protocol udp source-port 4500 destination-port 4500

set security policies from-zone green to-zone red policy pol1 match source-address sa1
set security policies from-zone green to-zone red policy pol1 match destination-address da1
set security policies from-zone green to-zone red policy pol1 match application custom-ike-alg
set security policies from-zone green to-zone red policy pol1 match application custom-ike-natt
set security policies from-zone green to-zone red policy pol1 then permit