topic Re: IPsec Tunnel with Loopback and NAT in General Topics

IPsec Tunnel with Loopback and NAT

CherieWatts — Mon, 05 Sep 2022 20:55:37 GMT

I have 2 questions.

1. I want to create an IPSec tunnel, using a loopback interface.

This removes a dependency on the main interface ip. ie if the loopback ip is :3.4.5.2, and the main internet ip is changed from 3.4.5.1 to 3.4.5.30, this then doesn't impact the IPSec tunnel.

After the IPSec tunnel is online.

2. I want to NAT the communication from different ip's across several internal subnets to a specific 10.x.x.x/24 subnet as the new "source". This subnet is then used to communicate to Site B's internal subnets. This masks Site A internal subnets and removes additional configuration requirements from Site B, when additional Site A subnets are enabled.

Can anyone direct me to the pertinent doco to look up how to do my NAT, ie question 2?

Doesn't anyone see any major issues with this design?

Thanks for any feedback

Re: IPsec Tunnel with Loopback and NAT

OtakarKlier — Tue, 06 Sep 2022 18:55:28 GMT

Hello,

So since the traffic is sourced from site A and you are putting the NAT into site A's firewall. You can use a Source NAT, if you are putting the NAT rules in firewall B, then use a Destination NAT.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/nat/source-nat-and-destination-nat/source-nat

Hope this helps.

Re: IPsec Tunnel with Loopback and NAT

CherieWatts — Wed, 07 Sep 2022 21:27:22 GMT

Hi OtakarKlier,

I implemented the site-to-site vpn yesterday and its all working correctly.

I am really happy.

Thanks

Cherie

Re: IPsec Tunnel with Loopback and NAT

OtakarKlier — Thu, 08 Sep 2022 19:44:05 GMT

Nice work!