Issue NAT via VPN tunnel - VPN zone to Trusted zone

L1 Bithead

Issue NAT via VPN tunnel - VPN zone to Trusted zone



I'm having a very similar issue with trying to configure a NAT translation from VPN to Trusted zone. In my case I'm building a VPN tunnel for monitoring using /32 ProxyIDs. My configuration VPN ProxyID is like the example below:


Remote:                       Local:         


My NAT is configured as follows.

Source Zone:                  Dest Zone:                  Source Address:         Dest Address:                Destination Trans:

VPN                                Trusted                           


I can't get the translation to happen when send pings from the VPN and that's what I need working.


If I switch from a Dest translation to Source translation it works when I ping from Trust to VPN.

Source Zone:            Dest Zone:                   Source Address:            Dest Address:             Source Trans:

Trusted                      VPN                             


What am I missing? Do I need to add a static route for the V-Router? To get to use tunnl.x?


Please advise. Thanks.



Tags (2)
L7 Applicator

I assume that you are not using  in your network internally.

It means that based on routing table traffic to this IP is sent towards Untrust zone.

So for NAT to match it should be VPN > Untrust (not Trust).


And you also might need second NAT rule if traffic is initiated from inside.

In this case it is Trust > VPN.


Enterprise Architect @ Cloud Carib
L1 Bithead

I'll try that. Thank you.

L1 Bithead

I don't have an Untrusted zone as an option. But yes the is just an object to match Proxy-ID setup in a VPN tunnel. It is not a part of an internal network. I do have active security polices allowing these Inside, DMZ and Subnets between them and the VPN zone.


Below is the destination NAT that doesn't work.


These are source NAT entries that work only when traffic is initiated from Trusted or DMZ resouces. When traffic is initiated from the VPN resource it doesn't work. Even when Bi-Directional is enabled. On most firewalls this source NAT configuration set to Bi-Directional is all that is required.


Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!