Scip and ipsec over nat/pat routers

An apparatus, comprising:

• a memory;
• and
• a processor coupled to the memory, wherein the processor is configured to perform the steps of:
• receiving a message by the first endpoint from the second endpoint, the message including an encrypted portion including a source port, a destination port, a source IP address, and a destination IP address;
• determining whether a table entry exists for the message;
• if the table entry exists, determining by the first endpoint whether a NAT router and/or a PAT router is between the first endpoint and the second endpoint based, at least in part, on the table entry and the encrypted portion of the message;
• and
• creating an IPSec encrypted tunnel using IPSec transport mode for further communications between the first endpoint and the second endpoint if a NAT router and/or a PAT router is determined to be between the first endpoint and the second endpoint.

A computer program product, comprising:

• a non-transitory computer readable medium comprising instructions which, when executed by a processor of a computer system, cause the processor to perform the steps of:
• receiving a message by the first endpoint from the second endpoint, the message including an encrypted portion including a source port, a destination port, a source IP address, and a destination IP address;
• determining whether a table entry exists for the message;
• if the table entry exists, determining by the first endpoint whether a NAT router and/or a PAT router is between the first endpoint and the second endpoint based, at least in part, on the table entry and the encrypted portion of the message;
• and
• creating an IPSec encrypted tunnel using IPSec transport mode for further communications between the first endpoint and the second endpoint if a NAT router and/or a PAT router is determined to be between the first endpoint and the second endpoint.