IPSec与NAT协同工作的研究

因特网网络层安全协议(IPSec)和网络地址翻译(NAT)不兼容,这严重限制了IPSec的应用范围。在分析IP-Sec与NAT不兼容原因、讨论IPSec与NAT协同工作的一些方法及所存在的问题的基础上,对UDP封装IPSec数据包方法中所存在的安全隐患,以及在NAPT环境下,外出的数据根据SPD的选择符无法正确定位SAD中的SA问题,提出了解决办法。

Research on the Coordination between IPSec and NAT

Application range of IP security protocol(IPSec) is badly restricted due to the incompatibility of IPSec and Network Address Translator(NAT).On the basis of analyzing the cause of the incompatibility between IPSec and NAT,and discussing the methods and the problems of the coordination between IPSec and NAT,this paper puts out the solution to hidden secure trouble about UDP encapsulation IPSec packet,to the circumstance of Network Address and Port Translation(NAPT),output data is unable to locate SA probloms in Secure Association Database(SAD) correctly by selector in Secure Policy Database(SPD).