UDP 4500
Synopsis
- UDP 4500 is the standard port for IPsec NAT Traversal (NAT-T), carrying IKE and encapsulated ESP when peers are behind NAT.
- It’s used by IKEv1/IKEv2 VPN stacks such as strongSwan, Libreswan/Openswan, and the built-in VPN clients/servers on Windows, macOS, iOS, and Android.
- Enterprise VPN gateways from Cisco ASA/Firepower, Fortinet FortiGate, Palo Alto Networks, Juniper SRX, SonicWall, MikroTik RouterOS, Ubiquiti/UniFi, and pfSense/OPNsense listen on UDP 4500 for IPsec tunnels.
- L2TP over IPsec deployments (e.g., Windows “L2TP/IPsec” and Meraki MX Client VPN) use UDP 4500 for NAT-T in addition to UDP 500/1701.
- Major cloud providers’ site-to-site VPNs—AWS Site-to-Site VPN, Azure VPN Gateway, and Google Cloud VPN—require UDP 4500 for their IPsec tunnels.
- Remote-access VPN clients like Cisco AnyConnect (when configured for IPsec/IKEv2), FortiClient, and Shrew Soft/GreenBow use UDP 4500 to traverse NAT.
- Security note: UDP 4500 endpoints are commonly targeted for IKE/IPsec brute-force and configuration-leak attacks (e.g., IKEv1 Aggressive Mode PSK guessing), so admins often restrict exposure and enforce strong authentication.
Observed activity
Last 30 days
Detailed chart