Create a Dummy IP that is Natted to hide the Internal Network IP addresses in IPSec VPN

emnoc wrote:

You need to look at ipnat pools. Use this reference and the section with NAT 

 

https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/754815/configuring-firewall-policies-on-hq friday night funkin

 

Make sure you place the post-NAT address/subnet into your ipsec-phase2 definitions not the original-ips.

 

So assume your nat'ing 192.168.3.0/24 behind 192.0.2.22/32

 

config vpn ipsec phase2-interface

    edit vpn2cisco

              set src-subnet 192.0.2.22/32

              set dst-subnet x.x.x.x/x # the remote-subnet at the cisco

    end

 

 

On the cisco the crypto-map would look something like this for the encryption domain

# define the local to remote subnet for the interesting traffic and wildcard mask

#

access-list 101 permit x.x.x.x  y.y.y.y.y  192.0.2.22 0.0.0.0

 

crypto map MAP1   

 set match address 101

 set peer a.b.c.d # address of FGT public ike-gateway

 set transform-set proposal1

 set isakmp-profile MY_IKE_PROFILE

 set security-association lifetime seconds 3600

 

Also don't forget you might need a no-nat o the cisco for the dstetination of 192.0.2.22

 

# assuming your local lan is behind name-interface "inside"

object network LAN_LOCAL

  subnet x.x.x.x 255.255.255.0

object network LAN_REMOTE

  subnet 192.0.2.22 255.255.255.255

 

nat (inside,outside) source static LAN_LOCAL LAN_LOCAL destination LAN_REMOTE LAN_REMOTE

YMMV

Ken Felix