Skip to main content
mladen85
mladen85
New Member
August 7, 2020
Question

Bidirectional NAT through IPSEC tunnel.

  • August 7, 2020
  • 1 reply
  • 4423 views

Hello Colleagues,

I am struggling to create the config so the traffic from the other side of the vpn tunnel is not reaching my server.

 

I have Established phase 1 and phase 2 of an IPSec tunnel - Site-to-site. 

Inside the encryption domain of phase 2 I use public IP as local network, because  the other side can only allow public IPs .

So in the Policy config(lan -to- vpn interface ph1) I have enabled nat with IP pool which is that nat-ed public IP in the encryption domain.

When i try to reach the other side there is no problem , but when they try to telnet me the traffic goes through the tunnel, but doesn't reach my server .

I guess i have to make some nat in the policy  ( vpn interface ph1 - to - lan ), and i tried but it doesn't work.

 

I have Static route for the site 2 network with outgoing interface - vpn ph1 

I have Policy rules for inbound and outbound traffic , and only outbound is working 

VPN tunnel is established and there is traffic going in and out, but from the other side packets cannot reach my server.

 

Thanks in Advance!!!!

Best Regards,

Mladen 

    1 reply

    A_Big_Moose
    A_Big_Moose
    New Member
    September 20, 2021

    I have this exact problem, were you able to resolve? If so how?

     

    Thank You

    emnoc
    emnoc
    New Member
    September 21, 2021

    Did you run "diag debug flow" ?

     

    So can you post the cfg and we need DNAT-vip.

     

    e.g

       show firewall vip <vip_name>

     

    next whatever address you use in the "vip" needs to be in your local+remote encryption domain

     

    So example

     

    ipsecSA out ------>         LAN private rfc1918  10.0.0.0/8 ( post nat 192.0.2.1 via ippool )--->   to customer 198.51.100.1

    ipsecSA in <------           LAN private rfc1918  10.0.0.0/8 ( VIP pre-NAT 192.0.2.1 ) <----from customer remote 198.51.100.1 or whatever

     

     

    Just use the NAT address pre/post and not the private or hidden address in your phase2. And if not obvious you need a route in the above example to the remote_subnet and the remote IKE-GW needs a route to your 192.0.2.1 ( not the private it has no clue about your private inside lan )

     

    Ping me in a DM if you need me to peer review or consult with you.

     

    Ken Felix

    Terms & ConditionsAccessibility statement