topic Re: NAT over IPSEC VPN without an IP on the Tunnel interface in General Topics

NAT over IPSEC VPN without an IP on the Tunnel interface

Hensley — Sun, 28 Feb 2016 01:18:43 GMT

Does anyone know if it is possible to NAT over an IPSEC VPN without assigning an IP address on the tunnel interface itself?

I tried but it doesn't seem possible.

Help!

Thanks,

Duane

Re: NAT over IPSEC VPN without an IP on the Tunnel interface

mvidic — Mon, 29 Feb 2016 06:36:15 GMT

What kind of NAT are you trying to do?

It is possible to do dynamic-ip-and-port source NAT for sure, I haven't triend other scenarios.

Re: NAT over IPSEC VPN without an IP on the Tunnel interface

reaper — Mon, 29 Feb 2016 07:17:43 GMT

Hi Duane

you can try adding a loopback interface in the same zone as the vpn interface, then create a nat rule using dynamic ip+port and nat sourced from the loopback

depending on your remote peer you may need to account for this by using proxy-IDs

hope this helps

Re: NAT over IPSEC VPN without an IP on the Tunnel interface

tsrivastav — Mon, 07 Mar 2016 16:41:26 GMT

If you want to configure a NAT rule you should be having an ip address on the interface either statically or assisgned via DHCP

Else that will be a Not nat rule for the traffic

Are you trying to use tunnel interface in NAT rule ?