topic Re: Issue NAT via VPN tunnel - VPN zone to Trusted zone in General Topics

Issue NAT via VPN tunnel - VPN zone to Trusted zone

bshuman — Wed, 11 Oct 2017 17:57:30 GMT

Hello

I'm having a very similar issue with trying to configure a NAT translation from VPN to Trusted zone. In my case I'm building a VPN tunnel for monitoring using /32 ProxyIDs. My configuration VPN ProxyID is like the example below:

Remote: Local:

3.3.3.3/32 172.25.40.3/32

My NAT is configured as follows.

Source Zone: Dest Zone: Source Address: Dest Address: Destination Trans:

VPN Trusted 3.3.3.3/32 172.25.40.3/32 10.100.10.10/32

I can't get the translation to happen when send pings from the VPN and that's what I need working.

If I switch from a Dest translation to Source translation it works when I ping from Trust to VPN.

Source Zone: Dest Zone: Source Address: Dest Address: Source Trans:

Trusted VPN 10.100.10.10/32 3.3.3.3/32 172.25.40.3/32

What am I missing? Do I need to add a static route for the V-Router? To get to 172.25.40.0/32 use tunnl.x?

Please advise. Thanks.

Ben

Re: Issue NAT via VPN tunnel - VPN zone to Trusted zone

Raido_Rattameister — Wed, 11 Oct 2017 19:04:02 GMT

I assume that you are not using 172.25.40.3/32 in your network internally.

It means that based on routing table traffic to this IP is sent towards Untrust zone.

So for NAT to match it should be VPN > Untrust (not Trust).

And you also might need second NAT rule if traffic is initiated from inside.

In this case it is Trust > VPN.

Re: Issue NAT via VPN tunnel - VPN zone to Trusted zone

bshuman — Tue, 24 Oct 2017 17:35:02 GMT

I'll try that. Thank you.

Re: Issue NAT via VPN tunnel - VPN zone to Trusted zone

bshuman — Thu, 26 Oct 2017 22:02:21 GMT

I don't have an Untrusted zone as an option. But yes the 172.25.43.1/32 is just an object to match Proxy-ID setup in a VPN tunnel. It is not a part of an internal network. I do have active security polices allowing these Inside, DMZ and Subnets between them and the VPN zone.

Below is the destination NAT that doesn't work.

These are source NAT entries that work only when traffic is initiated from Trusted or DMZ resouces. When traffic is initiated from the VPN resource it doesn't work. Even when Bi-Directional is enabled. On most firewalls this source NAT configuration set to Bi-Directional is all that is required.