Shared Gateway and VSYS

[slh]

Hi,

I've a basic setup with TWO vsys with separate vrouters on each vsys (Maketing and Sales ) and a shared Gateway. Some vpn Tunnels terminating on my shared gateway.

I need to implement some static NAT rules for my VPN tunnels, so far so good.

Routing 0.0.0.0/0 goes to the Shared gateway and of course other locally routes are routed locally by Vrouter on their respective Vsys.

But some address should be NAted before/through the VPN tunnel, which I thought should be configured on the shared gateway .But it doesn't work that way. I need to implement NAT rules on the MArketing or Sales Vsys.

Even a route from VSYS with destination the NAT address subnet towards vrouter of the Shared gateway doesn't seem to be cathed.

VIRTUAL ROUTER: RTVOUT01 (id 2)
  ==========
destination                                 nexthop                                 metric flags      age   interface
        next-AS
10.14.6.0/24                                vr VR-SGOUT                             5      A S          

But when you perform a routing test ...

run test routing fib-lookup ip 10.14.6.1 virtual-router RTVOUT01

--------------------------------------------------------------------------------
runtime route lookup
--------------------------------------------------------------------------------
virtual-router:   RTVOUT01
destination:      10.14.6.1
result:           route not found

I found on KB of Palo Alto

Update: Fixed in 4.0.8

there seem to be a problem with version 4.1 .

Question: Would it be advisable to integrate a Shared Gateway into another VSYS ( INTERNET) with his vrouter and interfaces attached ? Because now the Shared Gateway isn't attached to a VSYS ..

Would the function shared gateway still work ?

In the documentation the shared gateway only has the NAT possibility. If I attach it to a VSYS I suppose I do have Security and NAT policies ??

Thanks for any input ..

Patrick

[bvandivier]

Hi Patrick, what are you specific requirements with regards to applying NAT prior to your traffic ingressing your tunnel interface for VPN traversal?  Do you need to perform source translation, destination translation, or both?  Can you provide more details regarding your requirements or perhaps a specific example?

thank you,

-Bryan