Does NAT take effect on ESP packets

The source NAT and NAT server policies that allow the PAT are invalid to ESP packets. The source NAT and NAT server policies that do not allow the PAT are valid to ESP packets.

For S series switches (except S1700 switches), IPSG takes effect only for IP packets (except DHCP packets) but not for packets of other types such as ARP or PPPoE. With IPSG enabled, an S series switch checks only IPv4 packets in versions earlier than V200R001 and checks all IPv4 and IPv6 packets in V200R001 and later versions.