NAT over IPSEC VPN without an IP on the Tunnel interface

[Hensley]

Does anyone know if it is possible to NAT over an IPSEC VPN without assigning an IP address on the tunnel interface itself?

I tried but it doesn't seem possible.

Help!

Thanks,

Duane

[mvidic]

What kind of NAT are you trying to do?

It is possible to do dynamic-ip-and-port source NAT for sure, I haven't triend other scenarios.

[reaper]

Hi Duane

you can try adding a loopback interface in the same zone as the vpn interface, then create a nat rule using dynamic ip+port and nat sourced from the loopback

depending on your remote peer you may need to account for this by using proxy-IDs

hope this helps

[tsrivastav]

If you want to  configure a NAT rule you should be having an ip address on the interface either statically or assisgned via DHCP

Else that will  be a Not nat rule for the traffic

Are you trying to  use tunnel interface in NAT rule  ?