ESP verifies only the IP payload in NAT traversal, but the ESP port information will be encrypted causing the layer 4 information to be unusable with PAT. Using the IPsec NAT transparency feature…

ESP verifies only the IP payload in NAT traversal, but the ESP port information will be encrypted causing the layer 4 information to be unusable with PAT. Using the IPsec NAT transparency feature can solve this problem, the ESP packet is encapsulated in a UDP header and contains the information necessary to enable PAT to work.