same source IP first rule SNAT to inet, second rule DNAT into IPsec VPN

[hanno]

version 7.2.11

from same source IP first rule SNAT to inet, second rule DNAT into IPsec VPN; the issue is, FG takes always the DNAT pool address as source; even in the SNAT (outgoing interface) rule the FG takes the assigned pool addres as source, but sends the traffic to the destination in inet; result I get an outgoing hit to my SNAT rule, but the traffic doesn't come back; in sequence the SNAT rule comes before the DNAT rule destinations are not overlapping; the SNAT target in the internet are three host addresses; so very small; 

is there something I've to consider specifically? After my opinion the FG shall process the rules after sequence and SA/DA match before processing NAT rules;

Is there a good hint to get this solved?

thx br Hanno

[funkylicious]

thats kinda strange.

when you do a manual policy lookup for traffic, does it match always the same firewall rule for outbound to internet and towards the remote ipsec destination ? 

L.E. do you have central-nat enabled ?

[hanno]

central NAT is not enabled; but the policy lookup is strange; by looking to the logs, I filter for the source addresse; I see a lot of traffic coming from source; hitting several rules; to microsoft, to my special inet addrr I'm looking for ect.; all the hits show in details the source of my DNAT for the device; not the WAN address as should; by doing a policy lookup i.e. for the inet addr of my partner a complete other rule is hit; on the other hand, if my source tries to reach my partner in inet, the log traffic show the correct rule; I'm really upset

[funkylicious]

can you share a sanitized config of the dnat ?

[hanno]

please see below; this is DNAT outgoing to the tunnel und incoming from the tunnel; thank you for oyour interest BTW, thy Hanno

config firewall address

edit "POCT-BGA"
set uuid 22492baa-a5af-51ef-7245-27f53aa557a8
set type iprange
set comment "BGA ALB90 FlexPlus"
set start-ip 10.36.17.30
set end-ip 10.36.17.35
next
edit "POCT-AQURE"
set uuid 1b1901ec-6b81-51ef-d5b0-45b99d051548
set subnet 10.28.0.114 255.255.255.255
next

config firewall vip
edit "POCT-LB-iSTAT"
set uuid 0dba4e04-3e42-51f0-6023-36ad0f9479f2
set extip 10.106.246.50-10.106.246.51
set mappedip "10.36.17.40-10.36.17.41"
set extintf "any"
next
end

edit "POCT-LB-BGA"
set uuid 7ebc5ca0-758e-51ef-d544-d66a59ebeac9
set extip 10.106.246.40-10.106.246.45
set mappedip "10.36.17.30-10.36.17.35"
set extintf "any"
next

config firewall ippool
edit "POCT-CKP-BGA-Pool"
set type one-to-one
set startip 10.106.246.40
set endip 10.106.246.45
next

config firewall policy
edit 321
set name "CKP-LB-iSTAT/BGA-POCT"
set uuid 545ef5b2-3e42-51f0-4074-c6d946502b07
set srcintf "VPN-LaborBerlin"
set dstintf "lan"
set action accept
set srcaddr "POCT-AQURE"
set dstaddr "POCT-LB-iSTAT" "POCT-LB-BGA"
set schedule "always"
set service "ALL"
set logtraffic all
next

config firewall policy
edit 303
set name "POCT-BGA-LB"
set uuid a3c0c9a0-a63f-51ef-77b6-f92123819adb
set srcintf "lan"
set dstintf "VPN-LaborBerlin"
set action accept
set srcaddr "POCT-BGA"
set dstaddr "V-LAN LB"
set schedule "always"
set service "ALL"
set logtraffic all
set nat enable
set fixedport enable
set ippool enable
set poolname "POCT-CKP-BGA-Pool"
next

[funkylicious]

i would try using on the vips the real external interface instead of any and see if it solves anything.