> Source: [sk166037](https://support.checkpoint.com/results/sk/sk166037)

# sk166037 - Security Gateway is forced to use NAT_T ESP after force_nat_t is enabled

| Property | Value |
|----------|-------|
| Solution ID | sk166037 |
| Date Created | 2020-04-13 |
| Last Modified | 2020-04-19 |
| Technical Level | Advanced |
| Products | Security Gateway |
| Versions | R82.10, R82, R81.20 |
| OS | Gaia |
| Platform | 15000 |

## Symptoms

- * The Security Gateway sends NAT_T ESP after the user enables force_nat_t and offer_nat_t_initator in Guidbedit.
* vpnd.elg shows the following parameter change:

  ```
  
  Line 13591: 	:force_nat_t (true)
  	Line 13597: 	:offer_nat_t_responder_for_known_gw (true)
  	Line 13599: 	:ike_support_nat_t (true)
  	Line 13621: 	:offer_nat_t_initator (true)
  ```

* tcpdump shows that two peers are communicating using different ports:

  ```
  
  21:23:40.723314 IP 76.69.xx.xx.500 > 69.152.xx.xx.4500: isakmp: phase 2/others ? oakley-quick[E]
  21:23:44.725166 IP 76.69.xx.xx.500 > 69.152.xx.xx.4500: isakmp: phase 2/others ? oakley-quick[E]
  21:23:48.725272 IP 76.69.xx.xx.500 > 69.152.xx.xx.4500: isakmp: phase 2/others ? oakley-quick[E]
  ```

* One side of the peer is an R77.30 and lower Security Gateway, or an R80.10 and higher Security Gateway without force_nat_t enabled.
* SmartView monitor shows that the tunnel is up, but the tunnel is not encapsulated,
* Support nat_t is enabled in SmartConsole on both peers.<br />

## Cause

R80.10 with force_nat_t enabled will not use nat_t unless the peer is also set to use force_nat_t.   
The [Site to Site VPN R80.10 Administration Guide](https://sc1.checkpoint.com/documents/R80.10/WebAdminGuides/EN/CP_R80.10_SitetoSiteVPN_AdminGuide/html_frameset.htm) explains how to enable force_nat_t but does not specify that the receiving side also needs to have force_nat_t enabled even it does not initiate traffic.

<br />

## Solution

This solution requires authentication. Please log in to view the full solution.

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content