Pix-to-Pix VPN - BOTH BOXES BEHIND NAT!!!

I am considering a configuration for my site - can anyone here offer
any suggestions?

I have two sites, both sit behind CPE's configured w/ NAT via the ISP.

I would like to install two Cisco Pix boxes (each behind a NAT
device), one at each site and enable VPN connectivity between the two.
I've read in multiple places that 6.3 now supports NAT Traversal, but
I'd like to here it from you all as I've read many conflicting
reports.

If anyone can point me to specific configuration examples, it would be
much appreciated.

Thank you in advance,

Michael

 

:I am considering a configuration for my site - can anyone here offer
:any suggestions?

:I have two sites, both sit behind CPE's configured w/ NAT via the ISP.

:I would like to install two Cisco Pix boxes (each behind a NAT
:device), one at each site and enable VPN connectivity between the two.
: I've read in multiple places that 6.3 now supports NAT Traversal, but
:I'd like to here it from you all as I've read many conflicting
:reports.

Can you configure the CPE to forward all ESP packets to the
PIX? And all UDP 500? If you can do that, then just go ahead and
configure the PIXes, but make sure you don't configure AH.

If you can't forward ESP to the PIX then you will have to see if
you can get NAT-T to work. I believe you'll need UDP 4500 as well
as UDP 500 for that, and you'll have to configure
isakmp nat-traversal

http://www.ietf.org/internet-drafts/draft-ietf-ipsec-nat-t-ike-07.txt

I am a bit confused by section 7 of the draft,
"Recovering from the expiring NAT mappings"
That section (and one of the paragraphs under 8. Security Considerations)
appears to assume that one of the ends will not be NAT'ing. This
does not seem to fit in with the other paragraphs: the protocol otherwise
assumes that both ends might be NAT'ed.

Anyhow, this section just might give you trouble in your situation
where you have NAT on both ends.