IPSEC VPN NAT issue

[SThatipelly]

I have a VPN request where  peer's IP range is conflicting with one of my internal IP range. 

They are asking me if I can do a NAT on my end to resolve it but based on my experience it must be them who should do a NAT. 

please correct me if I'm wrong.

[SCantwell_IM · Accepted solution]

Here is the way I would recommend that you do it...

Scenario is overlapping subnets on both side of IPSec Tunnel.

Both sides need to NAT, to give the remote sides a different appearance/subnet.

2) A different option may be (not sure) to only SNAT from the remote side, inbound to your environment.

Different from the top example.

Both remote and local sites have overlapping subnets.

when traffic from remote side enters your FW, you SNAT it, and send it, inbound to your network, with bidirectional enabled.

Now a user/server, etc, will send back traffic to the SNAT'd address, and your FW will strip off the SNAT and send to the correct source address, across the VPN.

Questions??? 😛

Let me know.