Issue NAT via VPN tunnel - VPN zone to Trusted zone

[bshuman]

Hello

I'm having a very similar issue with trying to configure a NAT translation from VPN to Trusted zone. In my case I'm building a VPN tunnel for monitoring using /32 ProxyIDs. My configuration VPN ProxyID is like the example below:

Remote:                       Local:

3.3.3.3/32                   172.25.40.3/32

My NAT is configured as follows.

Source Zone:                  Dest Zone:                  Source Address:         Dest Address:                Destination Trans:

VPN                                Trusted                         3.3.3.3/32                  172.25.40.3/32              10.100.10.10/32

I can't get the translation to happen when send pings from the VPN and that's what I need working.

If I switch from a Dest translation to Source translation it works when I ping from Trust to VPN.

Source Zone:            Dest Zone:                   Source Address:            Dest Address:             Source Trans:

Trusted                      VPN                              10.100.10.10/32          3.3.3.3/32                   172.25.40.3/32

What am I missing? Do I need to add a static route for the V-Router? To get to 172.25.40.0/32 use tunnl.x?

Please advise. Thanks.

Ben

[Raido_Rattameister]

I assume that you are not using 172.25.40.3/32  in your network internally.

It means that based on routing table traffic to this IP is sent towards Untrust zone.

So for NAT to match it should be VPN > Untrust (not Trust).

And you also might need second NAT rule if traffic is initiated from inside.

In this case it is Trust > VPN.

[bshuman]

I'll try that. Thank you.

[bshuman]

I don't have an Untrusted zone as an option. But yes the 172.25.43.1/32 is just an object to match Proxy-ID setup in a VPN tunnel. It is not a part of an internal network. I do have active security polices allowing these Inside, DMZ and Subnets between them and the VPN zone.

Below is the destination NAT that doesn't work.

These are source NAT entries that work only when traffic is initiated from Trusted or DMZ resouces. When traffic is initiated from the VPN resource it doesn't work. Even when Bi-Directional is enabled. On most firewalls this source NAT configuration set to Bi-Directional is all that is required.