Create a Dummy IP that is Natted to hide the Internal Network IP addresses in IPSec VPN

[DullerB]

Hello Guys.

We are setting up IPSec to Cisco FirePower to FW101E.

I know how to setup site to site IPSec, but am not sure how I can NAT my Internal IP with a "dammy IP"so it can be used in the IPSec setup.

Anyway can Help?

[emnoc]

You need to look at ipnat pools. Use this reference and the section with NAT 

https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/754815/configuring-firewall-policies-on-...

Make sure you place the post-NAT address/subnet into your ipsec-phase2 definitions not the original-ips.

So assume your nat'ing 192.168.3.0/24 behind 192.0.2.22/32

config vpn ipsec phase2-interface

    edit vpn2cisco

              set src-subnet 192.0.2.22/32

              set dst-subnet x.x.x.x/x # the remote-subnet at the cisco

    end

On the cisco the crypto-map would look something like this for the encryption domain

# define the local to remote subnet for the interesting traffic and wildcard mask

#

access-list 101 permit x.x.x.x  y.y.y.y.y  192.0.2.22 0.0.0.0

crypto map MAP1   

 set match address 101

 set peer a.b.c.d # address of FGT public ike-gateway

 set transform-set proposal1

 set isakmp-profile MY_IKE_PROFILE

 set security-association lifetime seconds 3600

Also don't forget you might need a no-nat o the cisco for the dstetination of 192.0.2.22

# assuming your local lan is behind name-interface "inside"

object network LAN_LOCAL

  subnet x.x.x.x 255.255.255.0

object network LAN_REMOTE

  subnet 192.0.2.22 255.255.255.255

nat (inside,outside) source static LAN_LOCAL LAN_LOCAL destination LAN_REMOTE LAN_REMOTE

YMMV

Ken Felix

[donndenny]

emnoc wrote:

You need to look at ipnat pools. Use this reference and the section with NAT 

https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/754815/configuring-firewall-policies-on-... friday night funkin

Make sure you place the post-NAT address/subnet into your ipsec-phase2 definitions not the original-ips.

So assume your nat'ing 192.168.3.0/24 behind 192.0.2.22/32

config vpn ipsec phase2-interface

    edit vpn2cisco

              set src-subnet 192.0.2.22/32

              set dst-subnet x.x.x.x/x # the remote-subnet at the cisco

    end

On the cisco the crypto-map would look something like this for the encryption domain

# define the local to remote subnet for the interesting traffic and wildcard mask

#

access-list 101 permit x.x.x.x  y.y.y.y.y  192.0.2.22 0.0.0.0

crypto map MAP1   

 set match address 101

 set peer a.b.c.d # address of FGT public ike-gateway

 set transform-set proposal1

 set isakmp-profile MY_IKE_PROFILE

 set security-association lifetime seconds 3600

Also don't forget you might need a no-nat o the cisco for the dstetination of 192.0.2.22

# assuming your local lan is behind name-interface "inside"

object network LAN_LOCAL

  subnet x.x.x.x 255.255.255.0

object network LAN_REMOTE

  subnet 192.0.2.22 255.255.255.255

nat (inside,outside) source static LAN_LOCAL LAN_LOCAL destination LAN_REMOTE LAN_REMOTE

YMMV

Ken Felix

Thanks for the detailed explanation