Bidirectional NAT through IPSEC tunnel.

[mladen85]

Hello Colleagues,

I am struggling to create the config so the traffic from the other side of the vpn tunnel is not reaching my server.

I have Established phase 1 and phase 2 of an IPSec tunnel - Site-to-site. 

Inside the encryption domain of phase 2 I use public IP as local network, because  the other side can only allow public IPs .

So in the Policy config(lan -to- vpn interface ph1) I have enabled nat with IP pool which is that nat-ed public IP in the encryption domain.

When i try to reach the other side there is no problem , but when they try to telnet me the traffic goes through the tunnel, but doesn't reach my server .

I guess i have to make some nat in the policy  ( vpn interface ph1 - to - lan ), and i tried but it doesn't work.

I have Static route for the site 2 network with outgoing interface - vpn ph1 

I have Policy rules for inbound and outbound traffic , and only outbound is working 

VPN tunnel is established and there is traffic going in and out, but from the other side packets cannot reach my server.

Thanks in Advance!!!!

Best Regards,

Mladen 

[A_Big_Moose]

I have this exact problem, were you able to resolve? If so how?

Thank You

[emnoc]

Did you run "diag debug flow" ?

So can you post the cfg and we need DNAT-vip.

e.g

   show firewall vip <vip_name>

next whatever address you use in the "vip" needs to be in your local+remote encryption domain

So example

ipsecSA out ------>         LAN private rfc1918  10.0.0.0/8 ( post nat 192.0.2.1 via ippool )--->   to customer 198.51.100.1

ipsecSA in <------           LAN private rfc1918  10.0.0.0/8 ( VIP pre-NAT 192.0.2.1 ) <----from customer remote 198.51.100.1 or whatever

Just use the NAT address pre/post and not the private or hidden address in your phase2. And if not obvious you need a route in the above example to the remote_subnet and the remote IKE-GW needs a route to your 192.0.2.1 ( not the private it has no clue about your private inside lan )

Ping me in a DM if you need me to peer review or consult with you.

Ken Felix