Site-to-Site vpn and NAT

Reply
Highlighted
L0 Member

Site-to-Site vpn and NAT

Hello,

I have one vpn configuration question, I hope somebody can help...

I am configuring vpn site-to-site in my site PaloAlto, other site is not important in this case.

I am making source and destination NAT for the traffic that is used for vpn. The purpose of this NAT is that we have lot of vpn tunnels and we have similar IP networks on local and remote site. I want to make correct vpn configuration.

1. When I am configuring IPsec Tunnels and have to identify local and remote  ProxyID, what IP network I should add? pre nat or post nat  network ?

2. I have to configure a static rule for vpn traffic. What destination network should be in that way? is it pre nat or post nat network ? if I am adding pre nat network I faced problems that there are other static routes which is used in my local network (because some remote sites subnets are similar like my site subnets).

I hope I write everything clearly and somebody can help me

Thanks,

Arturas

Highlighted
L7 Applicator

Hi,

Please review the technote available at : https://live.paloaltonetworks.com/docs/DOC-1594

This whitepaper has some simple examples of NAT for overlapping subnets over IPSEC. Should help to get you started.

Highlighted
L3 Networker

Highlighted
L3 Networker

Q. When I am configuring IPsec Tunnels and have to identify local and remote  ProxyID, what IP network I should add? pre nat or post nat  network ?

A. If you are going Palo Alto to Palo Alto, ProxyIDs are not required - but, I suspect that is not the case do to the nature of your question, so the answer is post NAT.  It will be what the other side expects to see as the source address of the traffic.

Q. I have to configure a static rule for vpn traffic. What destination network should be in that way? is it pre nat or post nat network ? if I am adding pre nat network I faced problems that there are other static routes which is used in my local network (because some remote sites subnets are similar like my site subnets).

A.  Again, this will be the post NAT address.  The traffic coming from one side to the other will have a source address of what ever you source NAT it to.

NOTE:  Make sure that your ProxyIDs match on both sides of the tunnel.  If it is a Cisco ASA for example, the crypto map (ACL) will need to match the proxy IDs configured on your Palo Alto - only in reverse (local on your side is remote on the other and vise versa).

Hope this helps,

-chadd.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the Live Community as a whole!

The Live Community thanks you for your participation!