| Virtual Private Networks(VPNs) have attracted the attention of many organizations looking to both expand their networking capabilities and reduce their costs. IP Security Protocol(IPSec), designed by the Internet Engineering Task Force(IETF), has increasingly become a main technology in creating VPNs. However, it is showed that widespread Network Address Translation (NAT) devices are becoming major barriers to the deployment of the IPSec-based VPNs. What are the real reasons of the incompatibilities between IPSec and NAT .Is there any feasible solution? Is there any compromise consideration needed when a solution is implemented? This paper focuses on all of these questions and tries to clarify them.Firstly, a general picture of IPSec is introduced and the incompatibility between IPSec and NAT/NAPT is analyzed in detail in this paper. Then, two existing solutions, Realm-Specific IP (RSIP) and UDP encapsulation, are introduced and the latter will be preferred based on comparison. Next, after a further analysis, an improved version of UDP encapsulation is proposed and an implementing specification is presented.Finally, some performance and security issues resulted from the implementation of UDP encapsulation are discussed.The improved UDP encapsulation model and implementings pecification given in this paper may help to implement an UDP encapsulation instance over a current IPSec application. In addition, Some compromises on performance and security resulted from applying UDP encapsulation are put forward, which can be a reference for future work. |
