topic Re: VPN Behind Router Using NAT in Firewall and Security Management

VPN Behind Router Using NAT

JoSec — Tue, 19 Apr 2022 13:56:23 GMT

I have a situation where it would be easier if I can establish a Site to Site VPN from Checkpoint gateways (R80.40) behind an on-premise router doing NAT to two Availability Zones in AWS using a Palo Alto active passive cluster in each AZ functioning as active passive environments using BGP. My questions listed below.

1. Can I establish a site to site VPN behind the Router doing NAT? Is just as easy as changing the Link Selection to Statically Nated IP and using the public IP the router would use for NAT? If this is correct, any other configuration options.

2. If yes to above, any issue with doing this with Palo Alto gateways as the peer?

Thanks

Re: VPN Behind Router Using NAT

G_W_Albrecht — Tue, 19 Apr 2022 15:01:47 GMT

1. Possible to be established using NAT-T (UDP 4500) from CP GW to peer or peer to CP (sk32664).

Re: VPN Behind Router Using NAT

JoSec — Tue, 19 Apr 2022 15:08:34 GMT

Therefore, following sk32664 would require no configuration change to the Link selection?

Re: VPN Behind Router Using NAT

G_W_Albrecht — Tue, 19 Apr 2022 16:46:49 GMT

You can try or ask TAC - i would assume no. This only concerns IKE proposals, so not so much difference to usual IKE.

Re: VPN Behind Router Using NAT

the_rock — Tue, 19 Apr 2022 16:57:27 GMT

I had done this before and you dont need to do anything with link selection.

Andy

Re: VPN Behind Router Using NAT

JoSec — Wed, 20 Apr 2022 14:52:37 GMT

Thanks for the responses. I'll be setting this up in the next few weeks and will update this thread.

Re: VPN Behind Router Using NAT

the_rock — Wed, 20 Apr 2022 15:16:07 GMT

Definitely let us know the results mate.

Andy