IKE on UDP Port 500 Finally Crosses NAT: Cloudflare IPsec Gets NAT-T!
Hey everyone, it's me, Shii-chan! Today I brought a small but handy update: Cloudflare's IPsec tunnels just got a little smarter about NAT. It's low-key, but folks running tunnels across NAT will love it.
Cloudflare Changelog
developers.cloudflare.com
What was announced?
The IPsec implementation behind Cloudflare WAN and Magic Transit now supports standard NAT traversal (NAT-T). This comes from Cloudflare's Changelog. You can start IKE on UDP port 500 and automatically switch to UDP port 4500 once NAT is detected.
The story so far
Until now, devices behind NAT had to be manually configured to start IKE directly on UDP 4500. The standard flow of "begin on 500, move to 4500 when NAT is detected" couldn't complete its handshake across NAT environments.
What changes
From now on, devices behind NAT can start IKE on either UDP 500 or 4500. Sessions that begin on port 500 will properly transition to 4500 after NAT detection and succeed. Best of all, no Cloudflare-side configuration is required, and it's enabled across all IPsec tunnels automatically.
Dive Deep
The port flow is simple: UDP 500 first, then UDP 4500 after NAT is detected. Cloudflare has verified this on devices like VeloCloud SD-WAN, Cisco IOS-XE, and Juniper SRX.
The important part is that existing tunnel behavior stays the same. Port 500 connections without NAT, setups already using 4500, and the NAT detection logic are all unchanged, so your working tunnels won't break. For configuration details, check the GRE and IPsec tunnels docs.
Wrap-up
- IKE can now start on UDP 500 and auto-switch to 4500 after NAT detection
- No more manual "start on 4500" config for devices behind NAT
- No Cloudflare-side setup, and it's enabled on all IPsec tunnels
- Existing tunnel behavior is unchanged, so nothing breaks
This is a quiet win for network engineers running Magic Transit or Cloudflare WAN IPsec tunnels across NAT!
