topic Re: What to do when IPSec VPN proxy IDs are the same? in General Topics

What to do when IPSec VPN proxy IDs are the same?

OMatlock — Tue, 12 Dec 2017 22:09:45 GMT

Hi folks,

We have several IPSec VPN connections and luckily so far all with unique Proxy IDs.

I am trying to prepare when I create a new one and has the same Proxy ID as another.

I see this article and talks about creating a NAT both ways.

https://live.paloaltonetworks.com/t5/Featured-Articles/DotW-Help-with-IPSec-Proxy-IDs-with-overlapping-IPs/ta-p/69123

I wonder if there is a way to create the NAT for an entire network ID or subnet to translate to another?

Or are many NAT entries necessary?

Just checking if anyone may have comments or example?

Re: What to do when IPSec VPN proxy IDs are the same?

reaper — Wed, 13 Dec 2017 12:35:07 GMT

hi @OMatlock

if your peer is a route-based vpn capable device, you don't need proxy IDs (just fyi)

if you have subnet overlap with the remote peer, you can fake both source and destination network

eg both networks are 192.168.0.0/24, you could source nat 10.0.0.0/24 destination nat 10.0.1.0/24

then the remote end would translate inbound 10.0.1.0/24 to local 192.168.0.0/24 equivalent and leave the 'original' received 10.0.0.0/24 source IPs

Re: What to do when IPSec VPN proxy IDs are the same?

pulukas — Tue, 19 Dec 2017 13:27:37 GMT

Sounds like you are talking about having to deal with overlapping subnets between your multiple remote vendor networks. Yes you would have to use NAT then to overcome the routing overlap. This is the kb for overlapping subnets on vpn for PAN.

https://live.paloaltonetworks.com/t5/Tech-Note-Articles/Configuring-route-based-IPSec-with-overlapping-networks/ta-p/53337

Re: What to do when IPSec VPN proxy IDs are the same?

OMatlock — Tue, 19 Dec 2017 21:12:40 GMT

Thank you for that. This document is most helpful! I wondering if I can just configure NAT on one side (our firewall only)?

I plan to setup a test like this.

Re: What to do when IPSec VPN proxy IDs are the same?

pulukas — Thu, 21 Dec 2017 14:15:23 GMT

In your situation there is not a full overlap with the same ip address on both sides of the tunnel. Your hub site is the only one with the overlapping subnet. So you cannot solve this without the nat occuring on one of the two remote partners.

Your side will configure a normally with the nat subnet range as a normal object.

The actual nat occurs on the partner side on their device where they configure both the nat and use the nat range for the vpn configuration for their subnet as a static network to network nat.

Re: What to do when IPSec VPN proxy IDs are the same?

OMatlock — Thu, 21 Dec 2017 21:55:59 GMT

Thank you again.

I need to set this up in a test.