Howdy, I just have a question on a firewall policy that I have been playing around with. I have an IPSec tunnel between my agency and our parent agency allowing traffic to 2 subnets on their end (192.168.139.x). On my end, we have a supernet (172.19.41.x) passing clients using their application to their servers over that tunnel and everything is working well. However, the local LAN at my agency (192.168.56.x) is on a subnet that conflicts with one at the parent agency's, so we cannot pass that traffic over the IPSec tunnel. In an attempt to get around that, I created a firewall policy to pass the traffic but with a NAT IP Pool that falls within the allowed supernet, so the conflicting 192.168.56.x subnet is disguised as the allowed 172.19.41.x subnet. This works going out but does not work coming in. I can ping the parent agency's application server, but I can't connect to it from one of the end user computers. I have the two firewall policies for this below (sanitized), can anyone tell me if I have done anything incorrectly? We have a workaround so this is not critical per se I am just curious about the proper way to get this working. Thanks for any suggestions!
Router-01 # config firewall policy
Router-01 (policy) # edit "27"
Router-01 (27) # show
config firewall policy
edit 27
set name "LAN-to-ParentAgency"
set uuid 58b8379a-bbca-51ef-35e1-ad351d4b0010
set srcintf "Local-LAN"
set dstintf "Parent-VPN"
set action accept
set srcaddr "Local-LAN"
set dstaddr "Parent-LAN"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set ippool enable
set poolname "Supernet"
next
end
config firewall policy
edit 28
set name "ParentAgency-to-LAN"
set uuid 9e6cee52-bbca-51ef-d114-3e824fced3b6
set srcintf "Parent-VPN"
set dstintf "Local-LAN"
set action accept
set srcaddr "Parent-LAN"
set dstaddr "Local-LAN"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set ippool enable
set poolname "Supernet"
next
end
