PPTP NAT and site-to-site IPSEC VPN on same IP address

[santonic]

Hello.

I'm doing a firewall migration where i encountered a following situation:

- customer has site-to-site VPNs terminated on public IP address, let's say 1.1.1.1

- customer is using PPTP VPN solution which is also terminated on same IP address 1.1.1.1 and DNAT-ed to PPTP server, let's say on address 10.10.10.10

- on current fw they have a DNAT rule for just TCP 1723 and GRE protocol which translates packets with destination 1.1.1.1 to 10.10.10.10

But as PA doesn't support use of GRE (protocol or application) in NAT rules i have to make a more general rule which translates every packet coming to 1.1.1.1 to 10.10.10.10

Will site-to-site VPNs terminating on PA on IP address 1.1.1.1 still work in such scenario? Or will they be forwarded to PPTP server?

Best regards,

Simon

[santonic]

A bit more complications: yes i know I can make a no-nat rule above the mentioned DNAT rule for known VPN endpoints. But a couple of VPN endpoints will have dynamic IP addresses

[pulukas]

You can write your nat rules to be more specific on the port for forwarding in order to distinguish these two servers on the same ip address.

When you create the nat rule you can leave any source and make the destination port the PPTP port with the translation then to that server.

the site to site will arrive on the interface as IPSEC traffic and not hit the PPTP rule at all.

[santonic]

PPTP includes TCP session on port 1723 and GRE session.

Yes, I can make more specific NAT rule for TCP session.

But I can't use application or protocol in NAT rule so I can't make specific NAT rule for GRE.

I also can't make no-NAT rule to prevent NAT for VPN tunnels as it also uses ESP which can't be used in NAT policy.

[pulukas]

I had assumed that the dependent GRE session created by the PPTP session would nat with the ALG.  But this is apparently not the case as PPTP is not on this list of ALG that nat correctly.  You may want to open a case to see if there is a work around for this.

You may also want to be sure there is a feature request filed by your sales engineer to add PPTP to this list in a future release.

Applications that Support NAT ALG (Application Layer Gateway) Functionality