Here is the way I would recommend that you do it... Scenario is overlapping subnets on both side of IPSec Tunnel. Both sides need to NAT, to give the remote sides a different appearance/subnet. 2) A different option may be (not sure) to only SNAT from the remote side, inbound to your environment. Different from the top example. Both remote and local sites have overlapping subnets. when traffic from remote side enters your FW, you SNAT it, and send it, inbound to your network, with bidirectional enabled. Now a user/server, etc, will send back traffic to the SNAT'd address, and your FW will strip off the SNAT and send to the correct source address, across the VPN. Questions??? 😛 Let me know.
... View more