topic PPTP NAT and site-to-site IPSEC VPN on same IP address in General Topics

PPTP NAT and site-to-site IPSEC VPN on same IP address

santonic — Mon, 15 Dec 2014 12:53:44 GMT

Hello.

I'm doing a firewall migration where i encountered a following situation:

- customer has site-to-site VPNs terminated on public IP address, let's say 1.1.1.1

- customer is using PPTP VPN solution which is also terminated on same IP address 1.1.1.1 and DNAT-ed to PPTP server, let's say on address 10.10.10.10

- on current fw they have a DNAT rule for just TCP 1723 and GRE protocol which translates packets with destination 1.1.1.1 to 10.10.10.10

But as PA doesn't support use of GRE (protocol or application) in NAT rules i have to make a more general rule which translates every packet coming to 1.1.1.1 to 10.10.10.10

Will site-to-site VPNs terminating on PA on IP address 1.1.1.1 still work in such scenario? Or will they be forwarded to PPTP server?

Best regards,

Simon

Re: PPTP NAT and site-to-site IPSEC VPN on same IP address

santonic — Mon, 15 Dec 2014 12:57:44 GMT

A bit more complications: yes i know I can make a no-nat rule above the mentioned DNAT rule for known VPN endpoints. But a couple of VPN endpoints will have dynamic IP addresses

Re: PPTP NAT and site-to-site IPSEC VPN on same IP address

pulukas — Tue, 16 Dec 2014 00:02:00 GMT

You can write your nat rules to be more specific on the port for forwarding in order to distinguish these two servers on the same ip address.

When you create the nat rule you can leave any source and make the destination port the PPTP port with the translation then to that server.

the site to site will arrive on the interface as IPSEC traffic and not hit the PPTP rule at all.

Re: PPTP NAT and site-to-site IPSEC VPN on same IP address

santonic — Tue, 16 Dec 2014 07:28:15 GMT

PPTP includes TCP session on port 1723 and GRE session.

Yes, I can make more specific NAT rule for TCP session.

But I can't use application or protocol in NAT rule so I can't make specific NAT rule for GRE.

I also can't make no-NAT rule to prevent NAT for VPN tunnels as it also uses ESP which can't be used in NAT policy.

Re: PPTP NAT and site-to-site IPSEC VPN on same IP address

pulukas — Sat, 20 Dec 2014 13:27:09 GMT

I had assumed that the dependent GRE session created by the PPTP session would nat with the ALG. But this is apparently not the case as PPTP is not on this list of ALG that nat correctly. You may want to open a case to see if there is a work around for this.

You may also want to be sure there is a feature request filed by your sales engineer to add PPTP to this list in a future release.

Applications that Support NAT ALG (Application Layer Gateway) Functionality