I'm doing a firewall migration where i encountered a following situation:
- customer has site-to-site VPNs terminated on public IP address, let's say 18.104.22.168
- customer is using PPTP VPN solution which is also terminated on same IP address 22.214.171.124 and DNAT-ed to PPTP server, let's say on address 10.10.10.10
- on current fw they have a DNAT rule for just TCP 1723 and GRE protocol which translates packets with destination 126.96.36.199 to 10.10.10.10
But as PA doesn't support use of GRE (protocol or application) in NAT rules i have to make a more general rule which translates every packet coming to 188.8.131.52 to 10.10.10.10
Will site-to-site VPNs terminating on PA on IP address 184.108.40.206 still work in such scenario? Or will they be forwarded to PPTP server?
You can write your nat rules to be more specific on the port for forwarding in order to distinguish these two servers on the same ip address.
When you create the nat rule you can leave any source and make the destination port the PPTP port with the translation then to that server.
the site to site will arrive on the interface as IPSEC traffic and not hit the PPTP rule at all.
PPTP includes TCP session on port 1723 and GRE session.
Yes, I can make more specific NAT rule for TCP session.
But I can't use application or protocol in NAT rule so I can't make specific NAT rule for GRE.
I also can't make no-NAT rule to prevent NAT for VPN tunnels as it also uses ESP which can't be used in NAT policy.
I had assumed that the dependent GRE session created by the PPTP session would nat with the ALG. But this is apparently not the case as PPTP is not on this list of ALG that nat correctly. You may want to open a case to see if there is a work around for this.
You may also want to be sure there is a feature request filed by your sales engineer to add PPTP to this list in a future release.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!