Chapter 11 IPsec VPN for FortiOS 5.0 : Monitoring and troubleshooting : General troubleshooting tips : A word about NAT devices
  
A word about NAT devices
When a device with NAT capabilities is located between two VPN peers or a VPN peer and a dialup client, that device must be NAT traversal (NAT-T) compatible for encrypted traffic to pass through the NAT device. For more information, see “NAT traversal”.