> Source: [sk183962](https://support.checkpoint.com/results/sk/sk183962)

# sk183962 - VPN Tunnel Instability when using NAT Traversal (NAT-T) on port 4500

| Property | Value |
|----------|-------|
| Solution ID | sk183962 |
| Date Created | 2025-09-12 |
| Last Modified | 2025-10-08 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82, R81.20, R81.10 (EOS) |

## Symptoms

- * Remote Access Virtual Private Network (VPN) and Site to Site VPN tunnels using Network Address Translation Traversal (NAT-T) on port 4500 intermittently fail to establish or drop unexpectedly.

* NAT-T traffic fails to match implied rules and is dropped by the cleanup rule.

* The kernel table entry for NAT-T (key: 00001194) appears immediately after policy installation but disappears after some time.

* The `"fw tab -t natt_port -u -f"` command on the Security Gateway does not show entry for NAT-T port. In working situation, it shows an entry with 1194 (HEX for port 4500).

* The `"ps aux | grep iked"` command on the Security Gateway show that the IKED process ID (PID) is changing, indicating that the process is restarting frequently.

* The file *$FWDIR/log/iked.elg* shows similiar logs:  

  ```
  
  [iked12 [PID]]@gateway[DATE TIME] iked12: Tue Aug  5 09:28:00 2025 UDPProtocol::BindSocket: Can't
   bind socket on port 34512: Address already in use
   UDPProtocol::BindSocket: Can't bind socket on port 34512: Address already in use
   UDPProtocol::BindSocket: Can't bind socket on port 34512: Address already in use
   vpn_cmain: Couldn't find TOPO_SRV_ENABLED in registry, setting it to 1
   Unable to open '/vs0/dev/fw6v0': Connection refused
   fw_get_kernel_instance_num: Invalid instance num 0 - return 0 UDPProtocol::BindSocket: Can't bind
   socket on port 34512: Address already in use
  ```

  <br />

* Security Gateway Daemon (CPD) exits unexpectedly, and VPN services become unresponsive.

## Cause

The NAT-T kernel table entry (key: 00001194) is deleted on the Security Gateway after policy installation.

This causes the Gateway to drop NAT-T (port 4500) traffic by the cleanup rule instead of accepting it by the implied rules.

## Solution

[Contact Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Security Gateway / each Cluster Member / Security Group involved in the case.

**Hotfix installation instructions:**   
Refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

Related Articles:

* [sk180530 - NAT-T traffic from VPN clients does not match implied rule](https://support.checkpoint.com/results/sk/sk180530)

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content