External IP maps to other end of the VPN site-to-site

[Alex_K]

Hi!

I'm not sure if I maybe overthinking it, but is there a way to map an external IP in location A to an internal IP in location B over site-to-site VPN tunnel? I believe Ext IP has to be allowed in location B's firewall, correct? Unless, I can somehow mask it to go through the tunnel as part of the remote subnet to location B?

Thanks!

[Carl_Wallmark]

Hi,

Yes, that is very easy to do. However, the server on the "other" side (Site B), must be able to route back through the tunnel.

An example:

A client on the internet with IP 195.195.123.1 connects to firewall A.

Firewall A has a VIP which will point to an Internal IP in Site B, 192.168.1.1

The server in Site B with IP 192.168.1.1, will see the source IP 195.195.123.1, and will send his reply to 0.0.0.0/0.0.0.0 (default gateway), if firewall B will have a default route to the internet with 0.0.0.0/0.0.0.0, the client will never receive the reponse, as it would go out on the internet, and come from a different IP.

To solve this, you would need to NAT in firewall A, to lets say 10.1.1.1.

Then the Server in Site B will see 10.1.1.1 as source IP, and will route that back over the VPN tunnel, because in this example 10.1.1.0/24 is a known network in Site A.

The downside to this is that you will only see 10.1.1.1 as source IP in the server logs, but it will work.

I hope it was understandable :)

[Alex_K]

Thanks Selective!

I understand the concept but for whatever reason I can't make it to work. Here's what I'm doing:

Site A is 10.100.0.0/16 (allows all 192.168.1.0/24 traffic through the tunnel). External IP 170.171.172.173

Site B is 192.168.1.0/24 (allows all 10.100.0.0/16 traffic through the tunnel). Internal host 192.168.1.25

I created an IP address IP1 100.100.100.25 in Fortigate (Addresses), I created VIP1 170.171.172.173-->10.100.100.25 and VIP2 10.100.100.25-->192.168.1.25.

I build 2 policies:

NAT1 -  WAN->MGMT - External source -> VIP 1

NAT2 - MGMT->Tunnel - IP1 -> VIP 2

From what I understand, I'm getting a packet with 170.171.172.173 as the source in my WAN. It than being NATted into 10.100.100.25, and then it is being NATted again from 10.100.100.25 to 192.168.1.25 and being sent across the tunnel.

Let me know if my thought process is correct.

[Alex_K]

Still can't get it to work. Would someone be able to pin point me at what am I doing wrong here?

Seems like Selective hasn't been back online since his last reply.