>"but the IKE wants to go from udp port 500 to udp port 500, even if they later agree on nat-t over udp 4500, so you can't have two boxes behind the nat answeri

>"but the IKE wants to go from udp port 500 to udp port 500, even if they later agree on nat-t over udp 4500, so you can't have two boxes behind the nat answering IKE connections, right? " Not at all. The box handling IKE connection is not behind NAT it is in front of NAT, port 500 is on a public IP. Practically speaking it is usually the same box doing NAT and IPSEC. >"The flow can go outwards if one end is behind nat, but you can't have lots of ipsec-wanting clients behind same nat." No, that statement is completely false. The technique used is called "overloading", Cisco calls this PAT. It assigns a unique source port for each UDP or TCP session on the device doing the IPSEC termination.