To begin with I know the document Configuring IPSec VPN between overlapping networks.
Due to my lack of experience still I am not able to understand how I should create the NAT rules.
My objective is to configure the IPSec tunnel only on "my" side - one that will be accessed and should allow access to some servers in the 192.168.2.0/24 network.
Below I put some aqnonymised configuration info:
IKEv1 only mode
Local IP Address
Peer IP Address
IPSec Tunnel Proxy IDs
The overlapping network addresses are 192.168.2.0/24
I have to create a NAT rule to show them to the accessing partner as 10.0.2.0/24 network.
I would be grateful if someone could tell me how to create this NAT rule with static translation.
Thank You a LOT! 🙂
Is vpn tunnel interface in dedicated vpn zone? If yes do you have security policy to allow traffic from vpn zone to internal zone?
If you have not overridden default policies at the end then no log will appear to Monitor > Traffic if this traffic does not match to any existing security policy.
I suggest to enable packet capture filter and choose ingress interface tunnel interface that you have configured for that vpn.
And then check global counters with command below. Run it few times. What is output? Any drops?
> show counter global filter delta yes packet-filter yes
Thank you for this!! I was just about to open a ticket when I came across this post.
I have the exact situation, tried every possible NAT permutation possible and packets would still drop coming into the source-NAT'ed tunnel -- which do NOT show up in any log except the debug packet captures (and I have enabled logging on both inter and intra zone defaults).
The fix is creating that fake route back to the LAN interface in the static routes, worked immediately after adding that entry in. Really would be nice if Palo Alto's shotty 10-year old documentation on this subject (https://live.paloaltonetworks.com/docs/DOC-1594) actually worked or hinted that you need to create a dummy route back internally somewhere.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!