using virtual IP to forward DNS traffic from IPsec VPN to a private subnet

[TheChosenOne]

Hi Forum,

i have trouble granting access to my DNS-Server to a customer who is connected via IPsec.

My Setup:

172.16.10.11/32 Customer sNAT. All traffic from my customer has this source.

192.168.110.0/24 Loopback Interface as VPN NAT-Network

192.168.55.0/24 VLAN-Interface for internal Services

We have a working VPN Connection with these Phase2 entrys: 172.16.10.11 <=> 192.168.110.3

My first try was a VIP with Portforwarding like this: 192.168.110.3:53(UDP) => 192.168.55.2:53(UDP)

Of cause I added a policy for this:

source interface: IPsec Customer

destination interface: Internal Services

source: 172.16.10.11

destination: VIP 192.168.110.3

service: DNS

NAT: disabled

But this doesn't work. Next try was a virtual server. Also not working... Is it "wrong" to use a Transfer-Network on a loopback device?

If you need more information please ask. Thank you and best regards!

[rwpatterson]

Personally, i'm not a fan of 'any'. I would much rather prefer a VIP destination group with port forwarding to the same port allowed.

My two cents.