IPsec and NAT have a conflict. NAT modifies IP headers, but IPsec's integrity checks detect this as tampering. NAT-T (NAT Traversal) solves this by wrapping ESP packets inside UDP port .
During IKE negotiation, both peers detect if NAT exists between them. If so, they automatically switch to NAT-T. The UDP wrapper survives NAT translation while the ESP payload inside remains protected. Most modern implementations enable NAT-T by default.