Routing issues when using NAT over VPN

mathiasj — Sun, 05 Dec 2021 18:16:45 GMT

I'm looking at this document. https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClipCAC
It says our selected NAT addresses (2.2.2.0/24 on PA-2020 in this case) need to be routed to a tunnel interface, in order for policy lookup to work.

Let's imagine I'm using 2.2.2.0/24 on the PA-2020 for NAT'ing traffic not only towards PA-5050, but also towards 2 other parties (connected via tunnel.2 and tunnel.3).

Ideally I would prefer to put tunnel.1, tunnel.2 and tunnel.3 in three different zones, but I don't see this as an option, when reading this document.

Is my only option to put all tunnel interfaces (tunnel.1, tunnel.2 and tunnel.3) for parties, that I present 2.2.2.0/24 towards, in the same zone? And then simply route 2.2.2.0/24 to tunnel.1.

Or is there a way for me to use different zones for each VPN?

Re: Routing issues when using NAT over VPN

BPry — Mon, 06 Dec 2021 04:28:48 GMT

@mathiasj,

Are you trying to use the same NAT range across all three tunnel interfaces?

Re: Routing issues when using NAT over VPN

mathiasj — Mon, 06 Dec 2021 06:14:50 GMT

@BPry

Yes, that's right.

topic Re: Routing issues when using NAT over VPN in General Topics

Routing issues when using NAT over VPN

Re: Routing issues when using NAT over VPN

Re: Routing issues when using NAT over VPN