SNAT before IPSEC VPN

I have to create an ipsec ssl tunnel with a customer.

Everything seems fine, both phase 1 and phase 2 are up.

But, they asked me to SNAT an internal IP.

Tried to recreate the VPN in policy mode with the same settings - not working.

In phase 2 local subnet is 172.16.5.0/24 and remote is 10.1.43.0/24

They are expectig traffic from 172.16.5.170 to 10.1.43.5 using source nat 10.252.13.1.

Quote:

"As per the IDD traffic should be coming to our firewall from 10.252.13.0/27 subnet. Hence pls configure the source NAT at your end.

Source Address: 172.16.5.170

Destination Address: 10.1.43.5

Source NAT: 10.252.13.1"

How should I do this?

Thank you!

Best answer by emnoc

Apply the SNAT in the policy and add or create this SNAT ip.addr in the phase2 config if you are not using 0.0.0.0/0 aka quad 0s.

Ken Felix

emnocAnswer

New Member

Apply the SNAT in the policy and add or create this SNAT ip.addr in the phase2 config if you are not using 0.0.0.0/0 aka quad 0s.

Ken Felix

New Member

Thanks.

Created in phase 2 and followed the article from the Cookbook with overlapping subnets.

Now it's working!

Sign up