An engineer troubleshooting a site-to-site VPN finds a Security policy dropping the peer's IKE traffic at the edge firewall. Both VPN peers are behind a NAT, and NAT-T is enabled. How can the…

The correct answer is A. Add a Security policy to allow UDP/500. IKE negotiation always initiates on UDP/500, regardless of whether NAT-T is in use. When the IKE_SA_INIT exchange detects a NAT device, the session migrates to UDP/4500 for subsequent phases. If the edge firewall's Security policy is dropping IKE traffic, it is blocking the…

Submitted by obi.ng· Apr 18, 2026Configuration Troubleshooting

Question

An engineer troubleshooting a site-to-site VPN finds a Security policy dropping the peer's IKE traffic at the edge firewall. Both VPN peers are behind a NAT, and NAT-T is enabled. How can the engineer remediate this issue?

Options

AAdd a Security policy to allow UDP/500.
BAdd a Security policy to allow the IKE application.
CAdd a Security policy to allow the IPSec application.
DAdd a Security policy to allow UDP/4501.

How the community answered

(34 responses)

A
85% (29)
B
9% (3)
C
3% (1)
D
3% (1)

Explanation

IKE negotiation always initiates on UDP/500, regardless of whether NAT-T is in use. When the IKE_SA_INIT exchange detects a NAT device, the session migrates to UDP/4500 for subsequent phases. If the edge firewall's Security policy is dropping IKE traffic, it is blocking the initial UDP/500 exchange. Adding a rule to allow UDP/500 resolves the IKE phase. Option D references UDP/4501, which is not a valid NAT-T port (NAT-T uses UDP/4500), making it incorrect.

Topics

#VPN Troubleshooting#IKE#Security Policy#NAT-T

Community Discussion

No community discussion yet for this question.

Full PCNSE Practice