Special NAT configuration. Asking about possibility

[jeremylo]

I have a working Hub & Spoke VPN network. Computers in Spoke1 can reach the computers in Spoke2 and vice versa. 

For some reason, a particular device in Spoke2 with IP 172.16.200.62 can only be reached by the computers in the same subnet. 

I want to know is it possible to assign a 172.16.200.x IP address to the computers in Spoke1 when they attempt to connect to that special device. I'm not sure this will achieve my target or not, but at least I can learn a new NAT technique if such configuration does exist.

The 3 firewalls below are PA-820.

[JoergSchuetter]

Hello @jeremylo 

Why don't you apply a source NAT on Spoke 2 (hiding all requests to 172.16.200.62 behind the firewall interface 172.16.200.x)?

[Pawel_G · Accepted solution]

Hello,

Simple fix for this is by creating a NAT rule

Nat from Spoke1 to Spoke2 -

Source Zone - Tunnel Interface Spoke1

Source IP Address - 192.168.100.0/24

Destination Zone  - Tunnel Interface Spoke2

Destination Address - 172.16.200.0/24

Source Translation - Dynamic IP and Port

Translated IP - 172.16.200.100

I hope this will help

[jeremylo]

Bingo! It works!

Thanks Pawel.

[jeremylo]

Hello Joerg,

This is a solution too. However, I also want to keep track of which computer in Spoke1 have connected to Spoke2.