Technical Tip: Implement Source-NAT for IPsec interface

[iskandar_lie]

Description	This article describes how source-NAT for IPSec interface can be implemented.
Scope	FortiGate.
Solution	Let's consider the following network. Scenario:  The client (192.168.15.2) will communicate with the server (192.168.16.2). IPSec interface is the outgoing interface where source-nat is required to be implemented. Interface 'to_FGT2' is the IPSec interface at FGT1 – by default no IP-address is assigned to IPSec interface. Firewall policy from client to server: Test to see if the traffic from the client can reach the server Ping from client to server – *failed Check session on firewall –  FortiGate source-nats the traffic 192.168.15.2 with 10.191.35.112. Trace flow confirms the above session:   FortiGate basic behavior: it will choose the interface with the lowest index number, since the IPSec interface has no IP address, in this case, 'port1' is chosen. If the FortiGate uses Source-NAT for the IPSEC interface on HA environment with enabled mgmt and ha interface and if you configure ha-mgmt-interfaces to be an mgmt interface, the mgmt interface that has the lowest index is omitted from SNAT. Please refer to the following KB article :  Technical Tip: For HA environment with enabled mgmt and ha interface, how Source-NAT works for IPsec... There are at least two workarounds to resolve this situation: Assign an IP address to IPSec interface.      2. Define an ippool to be used at firewall policy. Workaround 1: 'Assign an IP address to IPSec interface' *Firewall policy stays the same as before. Workaround 2: 'Define an ippool to be used at firewall policy' Create IPpool: Assign IPpool to the firewall policy: Note: Make sure that the NATed source IP (172.16.1.1) is included in the phase2 selectors as a local address. Otherwise, the traffic will be dropped with msg="No matching IPsec selector, drop". The phase2 selectors can be verified on the GUI -> VPN -> IPsec Tunnels -> Edit -> Phase 2 Selectors. Since both workarounds will give us the same result, the results for both tests are here: Test to see if the traffic from the client can reach the server. Ping from client to server – *success Check session on the firewall: FortiGate source-nats the traffic 192.168.15.2 with 172.16.1.1. Trace flow confirms the above session: Conclusion: By default, IPSec created will have no IP address (if the outgoing interface is used for source-nat purpose) and FortiGate will choose any ip-address interface with the lowest index. There are at least two workarounds to resolve this situation:        * Assign an IP address to the IPSec interface. * Define an IPpool to be used at the firewall policy Related documents: Site-to-site IPsec VPN with two FortiGate devices Technical Tip: How to configure SNAT with IP pool Static SNAT Technical Tip: How to configure an IPsec tunnel with Overlapping Subnets using VIPs