Shared Gateway and VSYS

Reply
Highlighted
slh
Not applicable

Shared Gateway and VSYS

Hi,

I've a basic setup with TWO vsys with separate vrouters on each vsys (Maketing and Sales ) and a shared Gateway. Some vpn Tunnels terminating on my shared gateway.

I need to implement some static NAT rules for my VPN tunnels, so far so good.

Routing 0.0.0.0/0 goes to the Shared gateway and of course other locally routes are routed locally by Vrouter on their respective Vsys.

But some address should be NAted before/through the VPN tunnel, which I thought should be configured on the shared gateway .But it doesn't work that way. I need to implement NAT rules on the MArketing or Sales Vsys.

Even a route from VSYS with destination the NAT address subnet towards vrouter of the Shared gateway doesn't seem to be cathed.

VIRTUAL ROUTER: RTVOUT01 (id 2)
  ==========
destination                                 nexthop                                 metric flags      age   interface
        next-AS
10.14.6.0/24                                vr VR-SGOUT                             5      A S          

But when you perform a routing test ...

run test routing fib-lookup ip 10.14.6.1 virtual-router RTVOUT01

--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
virtual-router:   RTVOUT01
destination:      10.14.6.1
result:           route not found

I found on KB of Palo Alto

Update: Fixed in 4.0.8

there seem to be a problem with version 4.1 .

Question: Would it be advisable to integrate a Shared Gateway into another VSYS ( INTERNET) with his vrouter and interfaces attached ? Because now the Shared Gateway isn't attached to a VSYS ..

Would the function shared gateway still work ?

In the documentation the shared gateway only has the NAT possibility. If I attach it to a VSYS I suppose I do have Security and NAT policies ??

Thanks for any input ..

Patrick

Tags (4)
L5 Sessionator

Re: Shared Gateway and VSYS

Hi Patrick, what are you specific requirements with regards to applying NAT prior to your traffic ingressing your tunnel interface for VPN traversal?  Do you need to perform source translation, destination translation, or both?  Can you provide more details regarding your requirements or perhaps a specific example?

thank you,

-Bryan

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!