topic Re: Issue with NAT over Site-2-Site VPN in General Topics

Issue with NAT over Site-2-Site VPN

nvirmani — Fri, 26 Aug 2016 06:21:26 GMT

Hi there,

I am reasonably good with Palo Alto Firewall however struggling with the NAT over VPN. I am trying to hide some internal IPs behind 9.9.0.1/32 and 9.9.0.1/32 is configured in Proxy ID as Local host. VPN phase 3 comes up but i think the way i am doing NAT is wrong.

NAT policy is created is as follows

Source Zone Destination Zone Sourec Address Destination Address Destination Translation

VPN T rust 10.1.0.1 9.9.0.1 Internal Host 10.129.34.9

When i check on CLI it tells me that request for 9.9.0.1 will be translated to 10.129.34.9

PA-1(active)> test nat-policy-match source 10.1.0.1 destination 9.9.0.1 protocol 70

Destination-NAT: Rule matched: Total_VPN_NAT-1
9.9.0.1:0 => 10.129.34.9:0

I dont see request coming when i monitor the traffic. However when i packet capture i do see ping request coming but it dies off becuase of no return response.

Can someone help or suggest what could be wrong please?

Many Thanks

Re: Issue with NAT over Site-2-Site VPN

santonic — Fri, 26 Aug 2016 07:01:13 GMT

Ping comes through and is translated correctly? In that case check the routing for response maybe?

Re: Issue with NAT over Site-2-Site VPN

nvirmani — Fri, 26 Aug 2016 07:11:15 GMT

No i wudn't say ping comes thru because i dont see anything in monitor tab however when i capture the packet using packet capture tool i do see ping coming but my firewall isn't responding.

Routing is not a problem because other Proxy IDs are working fine. It only this specific IP which i am trying to NAT is having problem.

Re: Issue with NAT over Site-2-Site VPN

santonic — Fri, 26 Aug 2016 07:18:20 GMT

This packet isn't translated, it has original destination 9.9.0.1. Seems your NAT isn't working.

Re: Issue with NAT over Site-2-Site VPN

nvirmani — Fri, 26 Aug 2016 07:27:33 GMT

Thats what i think as well however when i check the CLI is does say 9.9.0.1 will be translated to 10.129.34.9.

PA-1(active)> test nat-policy-match source 10.1.0.1 destination 9.9.0.1 protocol 70

Destination-NAT: Rule matched: Total_VPN_NAT-1
9.9.0.1:0 => 10.129.34.9:0

Is there any way to check why my NAT rule isnt working please?

Re: Issue with NAT over Site-2-Site VPN

santonic — Fri, 26 Aug 2016 08:10:41 GMT

Is 9.9.0.1 in trust zone? If it isn't, NAT won't hit.

Re: Issue with NAT over Site-2-Site VPN

bmorris1 — Fri, 26 Aug 2016 09:01:05 GMT

Hi nvirmani,

When you run a test nat policy command, try putting in the 'to' & 'from' fields to include the zones, as your NAT rule is done with zones. Personally I always make the test commands as accurate as possible for the best results.

Ben

Re: Issue with NAT over Site-2-Site VPN

bshuman — Wed, 11 Oct 2017 17:51:01 GMT

Hello

I'm having a very similar issue with trying to configure a NAT translation from VPN to Trusted zone. In my case I'm building a VPN tunnel for monitoring using /32 ProxyIDs. My configuration VPN ProxyID is like the example below:

Remote: Local:

3.3.3.3/32 172.25.40.3/32

My NAT is configured as follows.

Source Zone: Dest Zone: Source Address: Dest Address: Destination Trans:

VPN Trusted 3.3.3.3/32 172.25.40.3/32 10.100.10.10/32

I can't get the translation to happen when send pings from the VPN and that's what I need working.

If I switch from a Dest translation to Source translation it works when I ping from Trust to VPN.

Source Zone: Dest Zone: Source Address: Dest Address: Source Trans:

Trusted VPN 10.100.10.10/32 3.3.3.3/32 172.25.40.3/32

What am I missing? Do I need to add a static route for the V-Router? To get to 172.25.40.0/32 use tunnl.x?

Please advise. Thanks.

Ben