IPsec Tunnel with Loopback and NAT

[CherieWatts]

Hi

I have 2 questions.

1. I want to create an IPSec tunnel, using a loopback interface.

This removes a dependency on the main interface ip. ie if the loopback ip is :3.4.5.2, and the main internet ip is changed from 3.4.5.1 to 3.4.5.30, this then doesn't impact the IPSec tunnel.

After the IPSec tunnel is online.

2. I want to NAT the communication from different ip's across several internal subnets to a specific 10.x.x.x/24 subnet as the new "source". This subnet is then used to communicate to Site B's internal subnets. This masks Site A internal subnets and removes additional configuration requirements from Site B, when additional Site A subnets are enabled.

Can anyone direct me to the pertinent doco to look up how to do my NAT, ie question 2?

Doesn't anyone see any major issues with this design?

Thanks for any feedback

[OtakarKlier]

Hello,

So since the traffic is sourced from site A and you are putting the NAT into site A's firewall. You can use a Source NAT, if you are putting the NAT rules in firewall B, then use a Destination NAT.

https://docs.paloaltonetworks.com/pan-os/10-2/pan-os-networking-admin/nat/source-nat-and-destination...

Hope this helps.

[CherieWatts · Accepted solution]

Hi OtakarKlier,

I implemented the site-to-site vpn yesterday and its all working correctly.

I am really happy.

Thanks

Cherie

[OtakarKlier]

Nice work!