A campus IOS XE router is behind NAT. The firewall permits UDP 500 and UDP 4500 toward an Azure VPN gateway. IKE starts and never moves onto UDP 4500. NAT traversal is disabled on the router. What should be enabled?
Select an answer to reveal the explanation.
Short Explanation
The firewall already opened the door you are refusing to walk through. You turn NAT traversal back on so the router can continue IKE on UDP 4500. Azure will not run OSPF to finish that handshake, and BGP is not what moves IKE off UDP 500.
Full Explanation
When a router detects NAT, NAT traversal moves the IPsec session to UDP 4500. This campus router has that behavior turned off, so the exchange stays on UDP 500 and never completes through the NAT device, even though the firewall already permits both ports. Enable NAT traversal on the router. The Azure VPN gateway does not run OSPF, and OSPF would not carry the IKE packets. A public virtual interface is a private-connectivity construct. It is not how an internet VPN gateway receives NAT traversal. BGP multihop raises the TTL of a BGP session between loopbacks. It does not change the UDP port IKE uses. Exam caveat: the peer address the gateway sees must still be the public address the NAT device uses. Enabling NAT traversal does not fix a peer address that points at the private inside host. Operational check: after it is enabled, a capture outside the NAT device should show UDP 4500 toward the Azure gateway, and the IKEv2 SA should reach a ready state.