VPN Tunnel IPSEC L2L VPN NAT not acting as intended

alliman — Thu, 03 Feb 2022 18:56:37 GMT

I am Labbing up a configuration I am about to go live with in production but it is not acting as it should when trying to apply a NAT rule to a tunnel interface. When I apply individual rules to the vpn traffic as I would like it to act I am not getting the intended result. I have to select bi-direction to get the NAT rule to act as it should. It works that way but it bugs me on why it is not working as intdended.
Zones:

WAN
VPN

LAB

NAT

NAT Rules

Name	Src Zone	Dest zone	dest int	src addr	dest adds	service	src translation	dest translation
VPN-OUT	LAB	VPN	any	192.168.110.0/24	any	any	static-ip 10.0.110.0/24 bi-directional: no	none
VPN-IN	VPN	VPN	any	any	10.0.110.0/24	any	none	address 10.0.110.0/24

If I change bi-directional to yes on VPN out the both directions work. If I leave it as NO the traffic does not hit VPN-IN no matter what I do.

any suggestions of what is going on is greatly appreciated.

Thanks,

Matt

Re: VPN Tunnel IPSEC L2L VPN NAT not acting as intended

OtakarKlier — Thu, 03 Feb 2022 21:14:58 GMT

Hello,

If you are using a bi-directional NAT. I would recommend you set it to yes. This prevent asymmetric routing and could cause applications to fail.

Here is an article that may help.

Regards,

topic VPN Tunnel IPSEC L2L VPN NAT not acting as intended in General Topics

VPN Tunnel IPSEC L2L VPN NAT not acting as intended

Re: VPN Tunnel IPSEC L2L VPN NAT not acting as intended