Where do you NAT external IPs for traffic through a VPN tunnel when a sub VDOM hosts the IPSec VPN?

[IrbkOrrum]

Background on environment.

Root vdom contains all the physical interfaces for traffic to the internet and vmware stack.  All traffic coming into or flowing out of the VDOMs has to route through Root.  Vdom-A and Vdom-B share IP schemes, so everything has to route through the Intervdom network 172.17.17.0/28.  Vdom-A has a VPN tunnel to another site.  The traffic to establish the VPN flows

Internet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel.

In my initial test, the VPN establishes and traffic flows so I know I've got that part set up correctly.  
However, Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN.  I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease of conversation) is going to have the NAT to the IP Pool done.  The "outgoing interface" should be the VPN but IP Pools aren't (so far) established until you're in the Root VDOM.  I'm just not sure where I should tell the firewall that 10.10.10.40 through the VPN tunnel, should be 40.40.40.40.

I've tried putting the NAT at VDOM A, so that the 'outgoing interface' is the VPN tunnel, that didn't seem to work. 

I've tried putting the NAT at Root vdom, but then the 'outgoing interface' can only be "outside" and that didn't seem to work.  I'm at a loss as to where that outbound NAT should be done.  To be completely fair, I'm really new to using VDOMs and figuring all this stuff out one stumbling block at a time.

[dingjerry_FTNT]

Hi @IrbkOrrum ,

You may use VIP with IPSec VPN.

Please check this KB and ignore the overlap part:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-an-IPsec-tunnel-with-Over...

[sjoshi]

To NAT the private IP 10.10.10.40 to the public IP 40.40.40.40 for traffic through the VPN tunnel in VDOM-A, you should configure the NAT at the root VDOM level. Create a Virtual IP (NAT) in the root VDOM, specifying the external IP as 40.40.40.40 and the mapped IP as 10.10.10.40. Ensure the outgoing interface is set to "outside" in the NAT configuration. This setup will allow traffic destined for 40.40.40.40 to be translated to 10.10.10.40 before being sent through the VPN tunnel established by VDOM-A.

[IrbkOrrum]

Oh so it should be a VIP, not an IP Pool where the NAT is happening inside the firewall rule?

EDIT

in 7.4 there is no "outgoing interface" that is specified.

[dingjerry_FTNT · Accepted solution]

Hi @IrbkOrrum ,

As long as the IPSec VPN is terminated in VDOM-A, what @sjoshi said is incorrect.

Because the packets sent to the IPSec VPN tunnel are encrypted and it is the IPSec VPN tunnel traffic passing through the root VDOM, the root VDOM can't even read the real payload of the IPSec VPN packets, how can we apply NAT in the root VDOM for your IPSec VPN traffic?

Please read the KB article I provided before.

[IrbkOrrum]

I did read that, but I didn't understand where I was implementing, at Root or at VDOM-A.  I guess it should be VDOM-A.  sjoshi's suggestion didn't seem to work anyway so I'll try yours but honestly I'm pretty sure I already did that, but I'll give it another go.

[dingjerry_FTNT]

Like @Toshi_Esumi said, without a diagram, I have to guess what it looks like since the info in your very first message is vague.

Please clarify whether the IPSec VPN is terminated in VDOM-A or not.  This is very important.

[IrbkOrrum]

Sorry, I did say in my post "Vdom-A has a VPN tunnel to another site. The traffic to establish the VPN flows

Internet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel." however I guess that wasn't clear enough that the IPsec VPN is terminated at VDOM-A.  I apologize. 

[IrbkOrrum]

This helped.  What I seemed to be missing was the the Inbound VIP on the VDOM-A side.  I created the VIP on VDOM-A to translate 40.40.40.40 to 10.10.10.40.  Then created the firewall rule with the incoming interface as the VPN tunnel, the outgoing interface as the appropriate VLAN, the source as the remote VPN's internal IPs, and the destination as the VIP I created earlier.  That seemed to do the trick.  Thanks. 

[dingjerry_FTNT]

Hi @IrbkOrrum ,

I am glad that your issue is resolved. If it did help you, please mark it as a solution.