Question regarding source NAT in S2S VPN

[shaq4242]

Hi All,

I need to create a S2S Tunnel to a customer. We need to reach 1 Server on their side (e.g. 192.168.100.1). The connection is needed from multiple Hosts from 2 different Subents on our Side (10.0.112.0/21 and 172.18.2.0/24). The customer does not want to allow both subnets instead they want to allow only 1 IP.

Now my question is: Is it possible to create a NAT Rule to do source NAT (Source Zone LAN, Source Adresses 10.0.150.0/24 and 172.18.2.0/24 --> Destination Zone VPN, Destination Address 192.168.100.1 --> Source Translation Dynamic IP and Port with IP e.g. 172.16.1.1. With that setup the customer only needs to allow the IP 172.16.1.1 inside the tunnel.

In my understanding this should work since it's the same sceanario as when multiple Hosts are going to the Internet with the same public IP, corect?

Thank you all!

[TomYoung]

Hi @shaq4242 ,

That is correct.  You could even skip the source subnets if you want.

Thanks,

Tom

[Glenyvie]

Did this setup worked?

[abayoumi21]

Yes — you absolutely can SNAT multiple internal subnets to a single IP inside the tunnel so the customer only allows one source IP.

It works exactly like Internet PAT logic, but inside the IPsec tunnel.

Additionally, you may create two separate NAT rules and perform static one-to-one NAT instead of dynamic IP and port if preferred.

Notes:

• The translated IP address must be included in the Phase 2 proxy IDs (local encryption domain).
• The peer must allow and route the translated IP inside the tunnel.
• The translated IP does not need to be an interface IP, but using a loopback or dedicated NAT IP range is considered best practice for design clarity