VPN remote peer with a LAN address

[mike406]

I need to create a VPN tunnel between my PA firewall with a regular external IP address and a remote non-PA peer that is behind some equipment (no details) and only has a local 172.17.x.x address. Is this possible?

If it is possible, do I use the external IP of the remote site even though the VPN connection will not be with that IP address?

I'm assuming the non-PA peer on the remote LAN will always need to initiate the connection, correct?

[rmfalconer]

If this is going over the internet, it won't be possible. RFC 1918 address space doesn't get routed over the internet.

Whatever sits in front of the other peer needs to do NAT for it to work.

[mike406]

Right. I understand public/private address spaces.

I also understand I will need NAT configured properly on the unknown router/firewall for this to work.

What I don't know is what value to use for the peer IP address, and then for authentication I'm assuming psk and email address or something like that will do the trick. AFAIK this can be done, I just haven't done it before.

[Brandon_Wertz]

How can you create a VPN tunnel to a device you have no information on?  It sounds like what you're really trying to do is "tunnel through" that FW to that end host. 

So you'd need the host to have some vpn/tunnel software that would actually create the VPN tunnel with your FW...(I would think this would be something the host network wouldn't allow.)  --edit-- seems like a perfect setup for some "haxorz" to go on ./

[mike406 · Accepted solution]

Couldn't get this working. The other end of the tunnel is on a LAN sitting behind gear I don't have access to so I can't configure or confirm NAT settings or port forwarding. Tried to get the device to initiate a connection, but it has limited configuration options and couldn't set an email address or other option for auth. Will have to figure out another way.