NAT traversal: Enable Network Address Translation (NAT) of the encrypted packets. If this parameter is disabled, NAT cannot be used on the encrypted VPN packets, because NAT modifies the header of the packets. Modified packets will be rejected by the remote endpoint, because they were modified by a third party (the device performing the network address translation).

Verbose IKE: Include log messages of the IKE protocol in the logs.

Send ICMP notification to the sender when fragmenting packets: If enabled and the VPN interface needs to fragment a packet, then the VPN interface sends a notification to the sender in an ICMP message. This allows the sender to lower its PMTU to avoid packet fragmentation.

Hide ToS: Remove the Type of Service parameter from the tunneled packets.