IPSec VPN with overlapping networks

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

IPSec VPN with overlapping networks

L2 Linker

To begin with I know the document Configuring IPSec VPN between overlapping networks.

Due to my lack of experience still I am not able to understand how I should create the NAT rules.

My objective is to configure the IPSec tunnel only on "my" side - one that will be accessed and should allow access to some servers in the 192.168.2.0/24 network. 

 

Below I put some aqnonymised configuration info: 

  IKE Gateway

Parameter

Value

Version

IKEv1 only mode

Address type

IPv4

Local IP Address

a.b.c.99

Peer IP Address

x.y.z.255

Exchange mode

auto

IPSec Tunnel Proxy IDs

Parameter

Value

Local

10.0.2.0/24 (NAT 1:1 – original subnet 192.168.2.0/24 )

Remote

10.95.0.0/16

 

The overlapping network addresses are 192.168.2.0/24

I have to create a NAT rule to show them to the accessing partner as 10.0.2.0/24 network.

 

I would be grateful if someone could tell me how to create this NAT rule with static translation.

 

Thank You a LOT! 🙂

23 REPLIES 23

Pkt Decap and Bytes Decap have values, the restof columns are zeros.

I have not overridden the default rules.

 

Is vpn tunnel interface in dedicated vpn zone? If yes do you have security policy to allow traffic from vpn zone to internal zone?

If you have not overridden default policies at the end then no log will appear to Monitor > Traffic if this traffic does not match to any existing security policy.

 

I suggest to enable packet capture filter and choose ingress interface tunnel interface that you have configured for that vpn.

packet filter.JPG

 

 

And then check global counters with command below. Run it few times. What is output? Any drops?

> show counter global filter delta yes packet-filter yes

Enterprise Architect, Security @ Cloud Carib Ltd
Palo Alto Networks certified from 2011

I would definitelly first check logs (and make sure you log everything).

If you can't find packet in logs then i would say PA isn't doing proxy ARP for static NAT rules.

L2 Linker

Below is the configuration that finally worked.

 

Static Route

 

01_Static_Route.png

 

NAT

02_NAT.png

 

Security rules

03_Security.png

Did you try only static route and only adding inbound NAT rule seperately? I'm curious what really was the original cause of issues.

I think the main problem was the lack of the static route.

The firewall was directing the traffic to 10.0.2.0 to the Internet as it was part of 0.0.0.0 route.

Thank you for this!!  I was just about to open a ticket when I came across this post.

 

I have the exact situation, tried every possible NAT permutation possible and packets would still drop coming into the source-NAT'ed tunnel -- which do NOT show up in any log except the debug packet captures (and I have enabled logging on both inter and intra zone defaults).

 

The fix is creating that fake route back to the LAN interface in the static routes, worked immediately after adding that entry in.  Really would be nice if Palo Alto's shotty 10-year old documentation on this subject (https://live.paloaltonetworks.com/docs/DOC-1594) actually worked or hinted that you need to create a dummy route back internally somewhere.

Hey, 

 

I have treid to do the same but seems the NAT rule and the security rule is not working. 

 

Also can you please let me know that in the second NAT rule what is the translated packet? destination address translation with static IP or dynamic?

Hello,

 

What addresses do we use in the security rules? The translated once or original?

 

Thanks

  • 17987 Views
  • 23 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!