Configure a NAT to traverse a VPN

[michael_lacey]

Hi want to be able to ssh to 10.18.68.75, which hits a NAT to go to 172.22.10.30, which should go over a VPN tunnel.

it isnt working and I get the following trace output;

id=20085 trace_id=1031 func=print_pkt_detail line=4784 msg="vd-root received a packet(proto=6, 10.109.2.120:50566->10.18.68.75:22) from port20. flag , seq 3125328171, ack 0, win 8192" id=20085 trace_id=1031 func=init_ip_session_common line=4935 msg="allocate a new session-0b3956e1" id=20085 trace_id=1031 func=fw_pre_route_handler line=182 msg="VIP-172.22.10.30:22, outdev-unkown" id=20085 trace_id=1031 func=__ip_session_run_tuple line=2808 msg="DNAT 10.18.68.75:22->172.22.10.30:22" id=20085 trace_id=1031 func=vf_ip_route_input_common line=2584 msg="find a route: flag=00000000 gw-169.254.44.249 via VPN1" id=20085 trace_id=1031 func=fw_forward_handler line=691 msg="Allowed by Policy-207:" id=20085 trace_id=1031 func=ipsecdev_hard_start_xmit line=157 msg="enter IPsec interface-VPN1" id=20085 trace_id=1031 func=ipsec_common_output4 line=759 msg="No matching IPsec selector, drop"

im not sure what the issue is?

[rwpatterson]

The easiest way to accomplish this would be to create an IP pool with a single UNUSED IP address on the subnet that is allowed over the VPN and NAT the traffic in the policy that is pointing to that destination. The downfall is that all clients connecting to that endpoint will appear to be from the single source IP address. If the IP pool IP address is used anywhere else in the organization, the firewall will silently drop any of the traffic originating from that host.

[AK]

Hello,

what are your SA Networks (Local / Remote) ?

We use many IPSec Tunnels with NAT in both direction.

For your example the

local network is 10.109.2.0/24

remote network is 172.22.10.0/24

First come the DNAT, then it goes to the Tunnel.

It comes from 10.109.2.120 and goes to 172.22.10.30

Regards

Andreas

[emnoc]

Your answer is the diag debug flow

"No matching IPsec selector, drop"

The proxyids must beallowed in the src/dst-subnet of the phase2 settings

Ken