Hello all I'd like some insight on this Currently we have an IPsec tunnel between two sites, site A is the client and site B is the service provider, there is an application server and web server on site B. On site B, the tunnel has the local address to be the ip of the web server and the ip of the application server and the remote address is a /32 host on site A and the firewall's LAN ip. On site A, the remote address is that of the web server and that of the application server, while the local is that of the /32 host and the firewall's LAN ip
all phase 2 selectors are up. the service provider mentioned for other users, that are currently on a different VLAN, to access the service on site B, a NAT should be created such that the user vlan source address will be translated to the firewall's IP address.
Is it possible to achieve this? I created a dynamic ip pool and entered the firewall's IP address as the NAT ip, but I'm still not lucky ?
If I'm correct your setup is, If this is not correct please share a network diagram to understand it better. Vlan------SITEA======VPN=====SITEB----Server
The traffic selector, you're having is on site A, Lan interface IP toward the Server all /32 subnet, and on-site B vice-versa,
If this is the setup and traffic is initiated from the VLAN side you cannot NAT it to LAN interface IP because the NAT function works either with outgoing interface IP or an IP pool, and if you're using an IP pool that IP can only be the outgoing interface IP/subnet or some random IP/ subnet which you've not configured on Firewall as an Interface IP, because firewall treat all interface IP as local IP and kernel route points towards the root, and kernel route take preference and packet will be dropped at the firewall.
yes that is correct, at your side traffic sector would be Random IP --- Remote IP And at the remote side, the traffic sector would be Remote IP ---- Random IP
Now on your side, You'll have to create a policy with NAT enabled and configure the random IP pool and add it as NAT IP (basically PAT), then the traffic will work from VLAN to the remote side, but if traffic is initiated from Remote side will not work as at your firewall side we're doing PAT.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.