topic Re: Special NAT configuration. Asking about possibility in General Topics

Special NAT configuration. Asking about possibility

jeremylo — Fri, 05 Mar 2021 08:17:11 GMT

I have a working Hub & Spoke VPN network. Computers in Spoke1 can reach the computers in Spoke2 and vice versa.

For some reason, a particular device in Spoke2 with IP 172.16.200.62 can only be reached by the computers in the same subnet.

I want to know is it possible to assign a 172.16.200.x IP address to the computers in Spoke1 when they attempt to connect to that special device. I'm not sure this will achieve my target or not, but at least I can learn a new NAT technique if such configuration does exist.

The 3 firewalls below are PA-820.

Re: Special NAT configuration. Asking about possibility

JoergSchuetter — Fri, 05 Mar 2021 08:42:23 GMT

Hello @jeremylo

Why don't you apply a source NAT on Spoke 2 (hiding all requests to 172.16.200.62 behind the firewall interface 172.16.200.x)?

Re: Special NAT configuration. Asking about possibility

Pawel_G — Fri, 05 Mar 2021 19:02:25 GMT

Hello,

Simple fix for this is by creating a NAT rule

Nat from Spoke1 to Spoke2 -

Source Zone - Tunnel Interface Spoke1

Source IP Address - 192.168.100.0/24

Destination Zone - Tunnel Interface Spoke2

Destination Address - 172.16.200.0/24

Source Translation - Dynamic IP and Port

Translated IP - 172.16.200.100

I hope this will help

Re: Special NAT configuration. Asking about possibility

jeremylo — Mon, 08 Mar 2021 02:00:18 GMT

Bingo! It works!

Thanks Pawel.

Re: Special NAT configuration. Asking about possibility

jeremylo — Mon, 08 Mar 2021 01:59:28 GMT

Hello Joerg,

This is a solution too. However, I also want to keep track of which computer in Spoke1 have connected to Spoke2.