diff --git a/client/WEB-INF/classes/resources/messages.properties b/client/WEB-INF/classes/resources/messages.properties
index e7beaa9304d..93e73fa1c7b 100644
--- a/client/WEB-INF/classes/resources/messages.properties
+++ b/client/WEB-INF/classes/resources/messages.properties
@@ -2258,3 +2258,4 @@ message.please.select.ssh.key.pair.use.with.this.vm=Please select a ssh key pair
 message.configure.firewall.rules.allow.traffic=Configure the rules to allow Traffic
 message.configure.firewall.rules.block.traffic=Configure the rules to block Traffic
 message.ldap.group.import=All The users from the given group name will be imported
+label.vpn.force.encapsulation=Force UDP Encapsulation of ESP Packets
diff --git a/client/WEB-INF/classes/resources/messages_nl_NL.properties b/client/WEB-INF/classes/resources/messages_nl_NL.properties
index 363be5f05ff..a4e199153ad 100644
--- a/client/WEB-INF/classes/resources/messages_nl_NL.properties
+++ b/client/WEB-INF/classes/resources/messages_nl_NL.properties
@@ -1726,6 +1726,7 @@ label.vpc=VPC
 label.VPN.connection=VPN Connectie
 label.vpn.customer.gateway=VPN Customer Gateway
 label.VPN.customer.gateway=VPN Customer Gateway
+label.vpn.force.encapsulation=Forceer UDP Encapsulatie van ESP Packets
 label.VPN.gateway=VPN Gateway
 label.vpn=VPN
 label.vsmctrlvlanid=Controle VLAN ID
diff --git a/ui/dictionary2.jsp b/ui/dictionary2.jsp
index 9d68974f045..4268104d825 100644
--- a/ui/dictionary2.jsp
+++ b/ui/dictionary2.jsp
@@ -1124,6 +1124,7 @@ under the License.
 'message.desc.create.ssh.key.pair': '<fmt:message key="message.desc.create.ssh.key.pair" />',
 'message.removed.ssh.key.pair': '<fmt:message key="message.removed.ssh.key.pair" />',
 'message.please.select.ssh.key.pair.use.with.this.vm': '<fmt:message key="message.please.select.ssh.key.pair.use.with.this.vm" />',
-'message.ldap.group.import': '<fmt:message key="message.ldap.group.import" />'
+'message.ldap.group.import': '<fmt:message key="message.ldap.group.import" />',
+'label.vpn.force.encapsulation': '<fmt:message key="label.vpn.force.encapsulation" />'
 });
 </script>
diff --git a/ui/scripts/docs.js b/ui/scripts/docs.js
index ed6ab0c938c..e02cbdac6f4 100755
--- a/ui/scripts/docs.js
+++ b/ui/scripts/docs.js
@@ -1118,6 +1118,10 @@ cloudStack.docs = {
         desc: 'Check this to make the virtual router query its IKE peer at regular intervals to ensure continued availability. It is recommended to have the same DPD setting on both sides of the VPN connection.',
         externalLink: ''
     },
+    helpVPNGatewayForceEncapsulation: {
+        desc: 'Force UDP encapsulation for ESP packets even if no NAT situation is detected. This may help to surmount restrictive firewalls. In order to force the peer to encapsulate packets, NAT detection payloads are faked',
+        externalLink: ''
+    },
     // Copy template
     helpCopyTemplateDestination: {
         desc: 'The zone to which you want to copy the template',
@@ -1329,4 +1333,4 @@ cloudStack.docs = {
     helpLdapLinkDomainAdmin: {
         desc: 'domain admin of the linked domain. Specify a username in GROUP/OU of LDAP'
     }
-};
+};
\ No newline at end of file
diff --git a/ui/scripts/network.js b/ui/scripts/network.js
index 2831aa00099..5fd917a62c2 100755
--- a/ui/scripts/network.js
+++ b/ui/scripts/network.js
@@ -6129,6 +6129,14 @@
                                         docID: 'helpVPNGatewayDeadPeerDetection',
                                         isBoolean: true,
                                         isChecked: false
+                                    },
+
+                                    forceencap: {
+                                        label: 'label.vpn.force.encapsulation',
+                                        docID: 'helpVPNGatewayForceEncapsulation',
+                                        docID: 'helpVPNGatewayForceEncapsulation',
+                                        isBoolean: true,
+                                        isChecked: false
                                     }
                                 }
                             },
@@ -6140,7 +6148,8 @@
                                     ipsecpsk: args.data.ipsecpsk,
                                     ikelifetime: args.data.ikelifetime,
                                     esplifetime: args.data.esplifetime,
-                                    dpd: (args.data.dpd == "on")
+                                    dpd: (args.data.dpd == "on"),
+                                    forceencap: (args.data.forceencap == "on")
                                 };
 
                                 var ikepolicy = args.data.ikeEncryption + '-' + args.data.ikeHash;
@@ -6196,7 +6205,8 @@
                                         ipsecpsk: args.data.ipsecpsk,
                                         ikelifetime: args.data.ikelifetime,
                                         esplifetime: args.data.esplifetime,
-                                        dpd: (args.data.dpd == "on")
+                                        dpd: (args.data.dpd == "on"),
+                                        forceencap: (args.data.forceencap == "on")
                                     };
 
                                     var ikepolicy = args.data.ikeEncryption + '-' + args.data.ikeHash;
@@ -6465,6 +6475,13 @@
                                         converter: cloudStack.converters.toBooleanText
                                     },
 
+                                    forceencap: {
+                                        label: 'label.vpn.force.encapsulation',
+                                        isBoolean: true,
+                                        isEditable: true,
+                                        converter: cloudStack.converters.toBooleanText
+                                    },
+
                                     id: {
                                         label: 'label.id'
                                     },
diff --git a/ui/scripts/vpc.js b/ui/scripts/vpc.js
index 4b10d8baeaf..f7f7329d6cd 100644
--- a/ui/scripts/vpc.js
+++ b/ui/scripts/vpc.js
@@ -2904,6 +2904,12 @@
                                                 return str ? 'Yes' : 'No';
                                             }
                                         },
+                                        forceencap: {
+                                            label: 'label.vpn.force.encapsulation',
+                                            converter: function(str) {
+                                                return str ? 'Yes' : 'No';
+                                            }
+                                        },
                                         state: {
                                             label: 'label.state'
                                         },