IPSec VPN with overlapping networks

[Filip_Fronczak]

To begin with I know the document Configuring IPSec VPN between overlapping networks.

Due to my lack of experience still I am not able to understand how I should create the NAT rules.

My objective is to configure the IPSec tunnel only on "my" side - one that will be accessed and should allow access to some servers in the 192.168.2.0/24 network. 

Below I put some aqnonymised configuration info: 

  IKE Gateway

Parameter	Value
Version	IKEv1 only mode
Address type	IPv4
Local IP Address	a.b.c.99
Peer IP Address	x.y.z.255
Exchange mode	auto

IPSec Tunnel Proxy IDs

Parameter	Value
Local	10.0.2.0/24 (NAT 1:1 – original subnet 192.168.2.0/24 )
Remote	10.95.0.0/16

The overlapping network addresses are 192.168.2.0/24

I have to create a NAT rule to show them to the accessing partner as 10.0.2.0/24 network.

I would be grateful if someone could tell me how to create this NAT rule with static translation.

Thank You a LOT! 🙂

[Filip_Fronczak]

Pkt Decap and Bytes Decap have values, the restof columns are zeros.

I have not overridden the default rules.

[Raido_Rattameister]

Is vpn tunnel interface in dedicated vpn zone? If yes do you have security policy to allow traffic from vpn zone to internal zone?

If you have not overridden default policies at the end then no log will appear to Monitor > Traffic if this traffic does not match to any existing security policy.

I suggest to enable packet capture filter and choose ingress interface tunnel interface that you have configured for that vpn.

And then check global counters with command below. Run it few times. What is output? Any drops?

> show counter global filter delta yes packet-filter yes

[santonic]

I would definitelly first check logs (and make sure you log everything).

If you can't find packet in logs then i would say PA isn't doing proxy ARP for static NAT rules.

[Filip_Fronczak · Accepted solution]

Below is the configuration that finally worked.

Static Route

NAT

Security rules

[santonic]

Did you try only static route and only adding inbound NAT rule seperately? I'm curious what really was the original cause of issues.

[Filip_Fronczak]

I think the main problem was the lack of the static route.

The firewall was directing the traffic to 10.0.2.0 to the Internet as it was part of 0.0.0.0 route.

[NickAssar]

Thank you for this!!  I was just about to open a ticket when I came across this post.

I have the exact situation, tried every possible NAT permutation possible and packets would still drop coming into the source-NAT'ed tunnel -- which do NOT show up in any log except the debug packet captures (and I have enabled logging on both inter and intra zone defaults).

The fix is creating that fake route back to the LAN interface in the static routes, worked immediately after adding that entry in.  Really would be nice if Palo Alto's shotty 10-year old documentation on this subject (https://live.paloaltonetworks.com/docs/DOC-1594) actually worked or hinted that you need to create a dummy route back internally somewhere.

[shreekantsingh]

Hey, 

I have treid to do the same but seems the NAT rule and the security rule is not working. 

Also can you please let me know that in the second NAT rule what is the translated packet? destination address translation with static IP or dynamic?

[BiljanaZafirovska]

Hello,

What addresses do we use in the security rules? The translated once or original?

Thanks