about Windows Gateway Ipsec and NAT compatibility issues

1. Simple Communication topology:

Use the Windows platform as a gateway, while IPSec and Nat are turned on to support private and public communication.

Note: There is no NAT between IPSec Gateway and Client1 IPSec, otherwise it is not the case described in this document. This article is only a work note and does not represent any official statement.

2. Description of the phenomenon:

A. Enable nat,but Disbale Ipsec.

Ping from 11.11.11.45 to 10.10.10.20 ok!

B. Enable Ipsec tunnel, Disable NAT

Ping from 11.11.11.45 to 10.10.10.20 ok!

C. Enable NAT and IPSec tunnel

Ping from 11.11.11.45 to 10.10.10.20 fail.

When I received this bug, I thought there was a problem with the customer network. Because both NAT and IPSec are very mature module. But this bug really happened to me, so I started a lot of source code tracking and mode.

3. Results:

After a lot of code analysis, this is a compatibility bug. However, only ICMP packets are affected. As a result of testing, TCP and UDP packets do not get affected and can communicate normally. So everyone Windows users Note: If the above network environment, the client ping different gateways, not the network cause, in addition to ICMP data, other protocol communication is not affected.

4, Reason brief:

The specific reason involves the source code, is not elaborated.