PPTP NAT and site-to-site IPSEC VPN on same IP address

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

PPTP NAT and site-to-site IPSEC VPN on same IP address

L6 Presenter

Hello.

I'm doing a firewall migration where i encountered a following situation:

- customer has site-to-site VPNs terminated on public IP address, let's say 1.1.1.1

- customer is using PPTP VPN solution which is also terminated on same IP address 1.1.1.1 and DNAT-ed to PPTP server, let's say on address 10.10.10.10

- on current fw they have a DNAT rule for just TCP 1723 and GRE protocol which translates packets with destination 1.1.1.1 to 10.10.10.10

But as PA doesn't support use of GRE (protocol or application) in NAT rules i have to make a more general rule which translates every packet coming to 1.1.1.1 to 10.10.10.10

Will site-to-site VPNs terminating on PA on IP address 1.1.1.1 still work in such scenario? Or will they be forwarded to PPTP server?

Best regards,

Simon

4 REPLIES 4

L6 Presenter

A bit more complications: yes i know I can make a no-nat rule above the mentioned DNAT rule for known VPN endpoints. But a couple of VPN endpoints will have dynamic IP addresses

L7 Applicator

You can write your nat rules to be more specific on the port for forwarding in order to distinguish these two servers on the same ip address.

When you create the nat rule you can leave any source and make the destination port the PPTP port with the translation then to that server.

the site to site will arrive on the interface as IPSEC traffic and not hit the PPTP rule at all.

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center

PPTP includes TCP session on port 1723 and GRE session.

Yes, I can make more specific NAT rule for TCP session.

But I can't use application or protocol in NAT rule so I can't make specific NAT rule for GRE.

I also can't make no-NAT rule to prevent NAT for VPN tunnels as it also uses ESP which can't be used in NAT policy.

I had assumed that the dependent GRE session created by the PPTP session would nat with the ALG.  But this is apparently not the case as PPTP is not on this list of ALG that nat correctly.  You may want to open a case to see if there is a work around for this.

You may also want to be sure there is a feature request filed by your sales engineer to add PPTP to this list in a future release.

Applications that Support NAT ALG (Application Layer Gateway) Functionality

Steve Puluka BSEET - IP Architect - DQE Communications (Metro Ethernet/ISP)
ACE PanOS 6; ACE PanOS 7; ASE 3.0; PSE 7.0 Foundations & Associate in Platform; Cyber Security; Data Center
  • 4137 Views
  • 4 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!