topic NAT before IPSEC in General Topics

NAT before IPSEC

Andrew_Bergt — Tue, 21 Dec 2021 22:55:36 GMT

Hi folks,

We have a vendor requiring a public IP for the encrypted traffic. Their guidance is based on Cisco configurations using "NAT before IPSEC" configurations. Can anyone share/link a guide for this configuration on Palo? Currently on PAN-OS 9.0 should it matter.

Thank you.

Re: NAT before IPSEC

TomYoung — Wed, 22 Dec 2021 17:51:03 GMT

Hi @Andrew_Bergt ,

NAT before IPsec is configured just like regular NAT except one of your interfaces will be your tunnel. The tricky part is that you need to add static routes to get NAT to work -> https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClipCAC.

Thanks,

Tom