When traversing a NAT, a local initiation of a phase 2 Security Association (SA) for a new dynamic tunnel with a remote security endpoint that is a security gateway is not supported. To use this configuration, the remote security endpoint must be the initiator. z/OS® is providing NAT traversal support for a defined group of configurations where z/OS is running the IKE daemon. See the information about IP security in z/OS Communications Server: IP Configuration Guide for a description of the supported configurations.