双向NAT环境下的IPSec隧道通信研究

随着Intemet规模的快速增长，NAT作为解决IP地址短缺的有效方法被大量应用于网络拓扑中。但NAT的出现带来了网络安全的复杂性，尤其在广泛应用的基于IPSec的VPN系统中，NAT对于IP报文的修改处理与IPSec协议对于IP报文的安全控制产生了极大的冲突，降低了IPSec安全策略对于网络的适应性。该文分析并比较了现有NAT与IPSec兼容性解决方案的技术关键点及其局限性。针对IPSec隧道双向穿透NAT的具体应用，传统的基于设备的点对点隧道协商方式已经无法满足需求。因此该文从VPN系统的角度给出了协作方式基于隧道接力的IPSec解决方案并进行了设计实现。最后该文对该系统的安全性及效率进行了评估。

Unobstructed IPSec Communication in Dual-NAT Environment

With the rapid development of Internet,NAT has gotten more and more extensive application as the solution for shortage of IP addresses. But NAT application has increased the complexity of network security.Especially NAT has brought the conflict with IPSec, between IP package transform and IP package control. This paper firstly compares the advantages and disadvantages between current methods in solving the compatibility of IPSec and NAT. As a illustration in the environment of both sides NAT application,the current methods have little effect. So based on a system precept, this paper refers a new system solution with tunnel relay for compatibility of IPSec and NAT. At last it gives design, implementation and security evaluation of the system.