Where do you NAT external IPs for traffic through a VPN tunnel when a sub VDOM hosts the IPSec VPN?

[IrbkOrrum]

Background on environment.

Root vdom contains all the physical interfaces for traffic to the internet and vmware stack.  All traffic coming into or flowing out of the VDOMs has to route through Root.  Vdom-A and Vdom-B share IP schemes, so everything has to route through the Intervdom network 172.17.17.0/28.  Vdom-A has a VPN tunnel to another site.  The traffic to establish the VPN flows

Internet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel.

In my initial test, the VPN establishes and traffic flows so I know I've got that part set up correctly.  
However, Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN.  I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease of conversation) is going to have the NAT to the IP Pool done.  The "outgoing interface" should be the VPN but IP Pools aren't (so far) established until you're in the Root VDOM.  I'm just not sure where I should tell the firewall that 10.10.10.40 through the VPN tunnel, should be 40.40.40.40.

I've tried putting the NAT at VDOM A, so that the 'outgoing interface' is the VPN tunnel, that didn't seem to work. 

I've tried putting the NAT at Root vdom, but then the 'outgoing interface' can only be "outside" and that didn't seem to work.  I'm at a loss as to where that outbound NAT should be done.  To be completely fair, I'm really new to using VDOMs and figuring all this stuff out one stumbling block at a time.

[Toshi_Esumi]

You should draw a diagram like I did for you last time to show us exactly where the VPN/DNAT needs to be performed, as well as where the access to 40.40.40.40 is coming from.
If the 10.10.10.40 is NOT in the root vdom, and say in VDOM-A, without having route to 10.10.10.40 the root VDOM's VIP wouldn't be able to pass the mapped/DNATed packets to VDOM-A. You have to configure it at VDOM-A side where the VDOM/router know where to route it to, as I said last time.

Toshi

[IrbkOrrum]

I appoligize.  I said in my post " Vdom-A will have a server with a "public IP" (let's call it 40.40.40.40 just for ease of conversation) that should be only accessible through the VPN. I'm having some difficulty in establishing where the private IP (let's call it 10.10.10.40 for ease of conversation) is going to have the NAT to the IP Pool done."  I guess that wasn't clear enough that 10.10.10.40 exists in VDOM-A.  Sorry, about that.

[dingjerry_FTNT]

Hi @IrbkOrrum ,

The key point, where is the IPSec VPN tunnel terminated?  In the root VDOM or the VDOM-A?

[IrbkOrrum]

As I said, in my post "Vdom-A has a VPN tunnel to another site. The traffic to establish the VPN flows

Internet > Root Vdom > VIP in Root VDOM that translates the external traffic to 172.17.17.1 (the vdom-a side intervdom link between Root and Vdom-A) > Vdom-A picks up and establishes the VPN tunnel." however I guess that wasn't clear enough that the IPsec VPN is terminated at VDOM-A.  I apologize. 

[Toshi_Esumi]

Then root vdom has nothing to do with your VIP operations. Everything happens at VDOM-A, if 40.40.40.40 lives in the vdom.
The root vdom is just passing VPN traffic through.

Toshi

[IrbkOrrum]

Well, this is not completely true as a VIP on the Root vdom is what passes the IPSec VPN traffic through to VDOM-A.  This is why I was not sure where the translation needed to sit.