4500

Port 4500/udp is the IPsec NAT-traversal port, registered with IANA under the service name ipsec-nat-t with the description "IPsec NAT-Traversal"; the IANA reference for the 4500/udp row is [RFC3948][RFC7296]. The same service name covers 4500/tcp, though that row carries a different reference ([RFC9329], TCP encapsulation of IKE/IPsec). It is the second half of the IPsec key-exchange pair: IKE begins on UDP 500, and when the peers detect a NAT device between them — via the NAT-Discovery payloads originally defined in RFC 3947 — they migrate the session to UDP 4500 and switch to UDP-encapsulating their ESP traffic, with the encapsulation format specified in RFC 3948 (January 2005). Wrapping ESP inside UDP/4500 datagrams (with a non-ESP marker so that IKE and ESP can be demultiplexed on the same port) gives NAT and PAT devices the port information they need to translate the flow, which plain ESP — having no ports — does not provide. The presence of 4500 therefore signals an IPsec gateway that expects clients sitting behind NAT, and it is almost always seen alongside 500/udp. Security here is generally that of the underlying IPsec configuration: risks come from weak crypto or authentication choices, IPsec-implementation CVEs, and denial-of-service against the gateway rather than from NAT-T itself. For an analyst, an open 4500/udp indicates an IPsec gateway with NAT-T enabled and warrants the same triage as 500/udp — check the IKE version and mode, and treat IKEv1 Aggressive Mode with a PSK as the high-value finding.

IANA assignment

ipsec-nat-t — "IPsec NAT-Traversal"; IANA reference for the 4500/udp row = [RFC3948][RFC7296] (modification date 2017-07-07); the 4500/tcp row shares the ipsec-nat-t service name but references [RFC9329]; no named assignee/contact or registration date shown in the registry

[IANA-assigned] — IANA Service Name and Transport Protocol Port Number Registry

Range class

registered (1024–49151)

Prevalence

in Nmap's default top-1000 UDP ports (de-facto, nmap-services) [Well-established] — nmap-services file

Related ports

500/udp (IKE — the pair), ESP (IP protocol 50), 1701 (L2TP/IPsec)

Primary use

UDP encapsulation of IPsec ESP for NAT traversal

Other/unofficial uses

L2TP/IPsec through NAT (often 500 + 4500 + 1701) [Well-established]

Security implications

generally as secure as the underlying IPsec config; risks from weak crypto/auth, IPsec-implementation CVEs, and DoS against the gateway; presence simply confirms an IPsec gateway expecting NATed clients

Typically seen on

VPN gateways, enterprise firewalls, client VPNs traversing NAT

Analyst note

An open 4500/udp = IPsec gateway with NAT-T enabled, almost always paired with 500/udp. Same triage as 500 (check IKE version/mode; Aggressive-Mode PSK is the high-value finding).