NAT-T Proxy Session Translation for IPsec Tunnel Multiplexing
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
NAT and IPsec protocols are incompatible, leading to transport mode conflicts when multiple clients behind a NAT device attempt to communicate with the same server, limiting remote client access and restricting the number of simultaneous sessions due to public IP address constraints.
Innovation Solution
A method that analyzes packets to identify new secure communication sessions, assigns session-unique addresses, and translates packets to allow multiple sessions to coexist without interference, using a NAT-T proxy to manage IPsec tunnels and maintain active sessions through state machines and timer management.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Productivity
If NAT is used to enable multiple hosts to share a common public IP address, then the number of accessible sessions increases, but transport mode conflicts arise when multiple clients behind NAT attempt to communicate with the same server using IPsec
Solution Approach 1:
The patent segments the shared public IP address by introducing session-unique identifiers (such as source port numbers or identification fields) that divide the single IP into multiple distinguishable session channels. Each session is uniquely identified within the NAT mapping, allowing multiple IPsec sessions to coexist without transport mode conflicts while sharing the same public IP address.
2Adaptability or versatility
If traditional NAT and IPsec are used together, then remote clients can access the secure network, but only one session per public IP address is allowed due to transport mode limitations
Solution Approach 1:
The patent adds another dimension to the IP address space by utilizing transport layer identifiers (such as UDP source port numbers) as an additional differentiating factor. Instead of relying solely on the IP address dimension, the system creates a two-dimensional identification space where each session is uniquely identified by the combination of public IP address and session-unique port/identifier, enabling multiple simultaneous sessions.
3Quantity of substance
If multiple clients share a common public IP address behind NAT, then public IP address conservation is achieved, but session identification and management become complex
Solution Approach 1:
The patent performs preliminary assignment of session-unique identifiers (such as source port numbers) when a session is established, before any potential conflicts can occur. The NAT device pre-configures the mapping between private session identifiers and public session identifiers, creating a lookup table that simplifies subsequent packet routing and session management, reducing complexity during active session handling.
Data Source
AI summary
A method of network communication and a network gateway are disclosed. The method and gateway operate between a secure network and remote clients by way of an intermediate transport network, such as the Internet. The remote clients connect through a NAT router so share a common source address on the intermediate transport network. In the secure network, the method analyses packets received from a remote client to identify packets that start a new secure communication session. Then, the method assigns a session-unique address and port to the new secure communication session. Subsequent packets are translated in the secure communication session by exchanging the source address with the local session address. Thus, the secure network perceived each session as originating from a distinct address and port, whereby several such sessions can coexist simultaneously.