Research on IPSec-based NAT-PT transition mechanism

摘要

Similar to conventional NAT technology, NAT-PT gateways break traditional TCP/IP's end-to-end argument property which result in IPSec can not be applied in NAT-PT environment, and would fall flat when the pool of IPv4 addresses is exhausted. A solution by adding IP transform message, modifying the address mapping tables and session tables, using port transform strategy with inner host computer character in IKE negotiation was proposed which implemented bidirectional communication among the nodes of IPv4 and IPv6, and made NAT-PT compatible with ESP and AH. Performance analysis shows that the proposed scheme is feasible and effective.