VPN中IPSec穿越NAT的解决方案

IP安全（IPSec）体系结构与网络地址转换（NAT）都是在因特网上得到广泛应用的技术，然而它们之间的不兼容性却制约着基于IPSec技术的虚拟专用网(VPN)发展。为解决两者之间的不兼容性，IETF提出了用户数据包协议(UDP)封装草案。但该草案对于IPSec通信双方均在NAT之后的情况，则还没提出可行的解决方法。在借鉴UDP封装方案和双向穿越NAT方案的基础上，给出了一种适应不同情形的NAT穿越解决方案，并对方案的可行性进行了详尽的分析。

Solution of IPSec NAT-traversal in virtual private network

IPSec architecture and Network Address Translation (NAT) are widely used in the Internet today.However, the incompatibility between them limits the development of Virtual Private Network (VPN) based on IPSec technology. The Internet Engineering Task Force (IETF) proposed a series of drafts based on User Datagram Protocol (UDP) encapsulation to solve this problem. But the solution did not cover the double NAT traversal in IPSec VPN. According to the methods of UDP encapsulation and double NAT-traversal, this paper proposed a feasible solution to solve the problem of NAT-traversal in different situations,and the feasibility was clarified in detail.