Which port should (or would) be open if VPN NAT-T was enabled?

A.
port 4500 outside interface

B.
port 4500 in all interfaces where ipsec uses

C.
port 500

D.
port 500 outside interface

Explanation:
NAT traversal: The encapsulation of IKE and ESP in UDP port 4500 enables these protocols
to pass through a device or firewall performing NAT.
https://en.wikipedia.org/wiki/Internet_Key_Exchange
https://supportforums.cisco.com/document/64281/how-does-nat-t-work-ipsec