IPSEC VPN NAT issue

SThatipelly — Tue, 08 Oct 2019 20:02:11 GMT

I have a VPN request where peer's IP range is conflicting with one of my internal IP range.

They are asking me if I can do a NAT on my end to resolve it but based on my experience it must be them who should do a NAT.

please correct me if I'm wrong.

Re: IPSEC VPN NAT issue

S.Cantwell — Wed, 09 Oct 2019 01:36:58 GMT

Here is the way I would recommend that you do it...

Scenario is overlapping subnets on both side of IPSec Tunnel.

Both sides need to NAT, to give the remote sides a different appearance/subnet.

2) A different option may be (not sure) to only SNAT from the remote side, inbound to your environment.

Different from the top example.

Both remote and local sites have overlapping subnets.

when traffic from remote side enters your FW, you SNAT it, and send it, inbound to your network, with bidirectional enabled.

Now a user/server, etc, will send back traffic to the SNAT'd address, and your FW will strip off the SNAT and send to the correct source address, across the VPN.

Questions??? 😛

Let me know.

topic IPSEC VPN NAT issue in General Topics

IPSEC VPN NAT issue

Re: IPSEC VPN NAT issue