# Ipsec behind NAT NAT-T **URL:** \ **Category:** IPsec\ **Created:** [3 December 2024 14:22 UTC](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268 "2024-12-03T14:22:23Z")\ **Posts on this page:** 4\ **Page:** 1
**Author:** ![aborenas](https://community.ipfire.org/user_avatar/community.ipfire.org/aborenas/32/12149_2.png) [@aborenas](https://community.ipfire.org/u/aborenas)\ **Post date:** [3 December 2024 14:22 UTC](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268/1 "2024-12-03T14:22:23Z")
Dec 3 16:16:43 front01 charon: 16[NET] sending packet: from 197.254.237.210[500] to 207.127.101.19[500] (36 bytes) Dec 3 16:16:46 front01 charon: 10[IKE] retransmit 3 of request with message ID 0 Dec 3 16:16:46 front01 charon: 10[NET] sending packet: from 197.254.237.210[500] to 195.229.199.4[500] (6076 bytes) Dec 3 16:16:47 front01 charon: 11[NET] received packet: from 195.229.199.4[500] to 197.254.237.210[500] (36 bytes) Dec 3 16:16:47 front01 charon: 11[ENC] invalid notify data length for INVALID\_KE\_PAYLOAD (0) Dec 3 16:16:47 front01 charon: 11[ENC] NOTIFY payload verification failed Dec 3 16:16:47 front01 charon: 11[IKE] message verification failed Dec 3 16:16:47 front01 charon: 11[IKE] IKE\_SA\_INIT response with message ID 0 processing failed ---
**Author:** ![bonnietwin](https://community.ipfire.org/user_avatar/community.ipfire.org/bonnietwin/32/12350_2.png) [@bonnietwin](https://community.ipfire.org/u/bonnietwin)\ **Post date:** [9 December 2024 16:24 UTC](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268/2 "2024-12-09T16:24:59Z")
Hallo @aborenas Welcome to the IPFire community. > [@aborenas](#): > > Dec 3 16:16:47 front01 charon: 11[ENC] invalid notify data length for INVALID\_KE\_PAYLOAD (0) Searching on this error message I have found the following comments. ```auto The above error is seen due to the mismatch in the PFS (Perfect Forward Secrecy) setting of the IPSEC VPN. - Verify if the PFS is enabled on both peers. - Verify if the DH-Group is same on both end. ``` Hope this gives some clue as to where to look. ---
**Author:** ![aborenas](https://community.ipfire.org/user_avatar/community.ipfire.org/aborenas/32/12149_2.png) [@aborenas](https://community.ipfire.org/u/aborenas)\ **Post date:** [10 December 2024 14:11 UTC](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268/3 "2024-12-10T14:11:35Z")
DH-GROUP in ipfire written in different for example my peer sent me that his configuration is DH-group 14 what the matching ipfire list thank and love ---
**Author:** ![tphz](https://community.ipfire.org/user_avatar/community.ipfire.org/tphz/32/16551_2.png) [@tphz](https://community.ipfire.org/u/tphz)\ **Post date:** [10 December 2024 15:10 UTC](https://community.ipfire.org/t/ipsec-behind-nat-nat-t/13268/4 "2024-12-10T15:10:23Z")
Just to add to the information [https://www.ipfire.org/blog/ipfire-2-27-core-update-170-released](https://www.ipfire.org/blog/ipfire-2-27-core-update-170-released) [https://docs.strongswan.org/docs/latest/config/proposals.html](https://docs.strongswan.org/docs/latest/config/proposals.html) Regards