For greater compatibility between IPsec and NAT

The principle and use of address translation are described at and .

In general, a piece of equipment is placed at the border of a site and is responsible for translating the site's private addresses into public addresses for each outgoing packet on the Internet, and vice versa for incoming packets. These public addresses are used by the public network to route IP packets to the site. If the number of public addresses available to a site is insufficient, the address translator may also translate port numbers, as is currently the case on many networks.

IPsec protocols, as described in the previous paragraphs, are naturally incompatible with address/port number translation. More specifically, the incompatibility problem arises when the translator is placed between two IPsec devices (see figure