NAT' ing within a VPN tunnel

[#1]

We have been asked to setup a VPN tunnel between ourselves and a 3rd party to us. They will be providing access to an application over this tunnel. The tunnel is no problem for us to setup however, the internal ip range we currently use is already in use by them at their end or overlaps a current range of theirs. I was wondering if it were possible to NAT traffic inside a tunnel on an F310b so we could use a completely new ip list and then NAT that to our users/servers etc. We both use a 10 range internally and they have asked if we could use a 192 range and then NAT that to our 10 range. We have obviously had thoughts about using VIPS but can VIPS be used inside a VPN tunnel? Any help would be very much appreciated.

[#2]

Ede Many thanks for that - what addresses then should phase 2 of the tunnel have as the source and destination addreses. At the moment I have 10.1.0.0./16 as the source and 192.168.23.1-192.168.23.254 as the destination in the quick mode selector settings - shouldn' t there be my address in there somewhere so 10.66.0.0/22 Thanks

[ede_pfau]

Andy, no I don' t think so, as NAT is only applied after the packet leaves the tunnel. The remote end will never see your private subnet (10.66.0.0). That' s the whole idea behind NATting so there won' t be ambiguities in addressing.

[#4]

Big - change I' ve now managed to get the tunnel up so great thanks for your help on that. However I can only see traffic inbound as there is no routing back to them - what do I need to put in give the VIP as we overlap addresses? Thanks again for your help with this Andy

[ede_pfau]

Router>Static Route>Add subnet 10.1.0.0/22 gateway your_tunnel (= phase1 name) distance 10 (or just the default value) Can you ping 10.1.0.1 (if valid)? From the FG CLI, and from a host in your LAN? just for the record, what are your QM setting now?

[#6]

QM Settings are 192.168.23.1-192.168.23.254 as source with destination as 10.1.0.0/16 So with the routing in place do I need an additional Int to Ext policy or will the routing do that The only policy currently in place is the one you advised ealier in the post. Thanks Andy

[willem]

Andy, in interface mode you indeed need a policy in each direction. Kind regards, Willem

[#8]

Looks like the static route may effect internet access from the servers - I have removed this whilst I do some more testing. What needs to be in the outgoing rule given we are going from our 10.66.0.0 range to the 192.168.23.0 (VIP) and then over to them in the 10.1.0.0 range

[ede_pfau]

For _reply_ traffic you only need an incoming policy. If you want to generate _outgoing_ traffic from your LAN to 10.1.0.0 you need an outgoing policy, like from LAN, interface internal to supplier_subnet (10.1.0.0./16), interface myTunnel (!) services all (or whatever) NAT, dynamic, IP pool and an IP pool (Firewall>IP pool) with " 10.66.1.0/24" . Do you have the static route in place? What about the other side?

[#10]

Thanks for that - I put a static route in and then faced another problem - all of the servers that are part of my internal range only on the 10.66.0.1 range couldn' t access the internet anymore - why I don' t know. I followed the advice above from you - would all traffic be routed over the tunnel? Andy

[ede_pfau]

Internet traffic, i.e. traffic to unknown addresses, follows the route with destination ' 0.0.0.0/0' . This is called the default route. Can you post your active routing table, with the route you' ve disabled enabled again? from the CLI: get router info routing all what is the gateway of your LAN' s hosts?