https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146962#M23398 <P>This works good for two peers in one community, but tends to go more complicated for every peer added.</P> Mon, 25 Apr 2022 09:21:05 GMT G_W_Albrecht 2022-04-25T09:21:05Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146815#M23361 <P>sorry if i'm wrong, as i said before i never dealt with nat. But from what I've read, wouldn't a hide nat on their side be enough? so the subnet I want comes directly to me</P> Fri, 22 Apr 2022 06:40:56 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146815#M23361 fabiofabio 2022-04-22T06:40:56Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146825#M23362 <P>Always the best solution is to change one of the overlapping networks ! Using NAT is surely possible for a single VPN tunnel, but as soon as more tunnels and more overlapping networks add up, configuration gets harder and harder !</P> Fri, 22 Apr 2022 07:42:26 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146825#M23362 G_W_Albrecht 2022-04-22T07:42:26Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146827#M23363 <P>Certainly! in fact I have more vpn tunnels and this is the first time that I happen to have to use the nat to work around the problem. So do you recommend using hide nat or static nat? and in what way?</P> Fri, 22 Apr 2022 07:47:55 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146827#M23363 fabiofabio 2022-04-22T07:47:55Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146831#M23364 <P>I recommend to change the overlapping internal network. The alternative is a lot of headache:</P> <P><A class="cp_link sc_ellipsis" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk170812&amp;partition=Advanced&amp;product=IPSec" target="_blank">sk170812: <STRONG>Route</STRONG> Based <STRONG>VPN</STRONG> solution for Overlapping Encryption Domains</A></P> Fri, 22 Apr 2022 07:55:17 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146831#M23364 G_W_Albrecht 2022-04-22T07:55:17Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146833#M23366 <P>in this case, it is a very large subnet, I cannot change it. I will try to convince the supplier to change it, but if it is not even possible on his part, how is it possible to solve with the nat?</P> Fri, 22 Apr 2022 08:01:11 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146833#M23366 fabiofabio 2022-04-22T08:01:11Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146835#M23367 <P>The alternative is some headache<span class="lia-unicode-emoji" title=":winking_face:">😉</span>:</P> <P><A class="cp_link sc_ellipsis" href="https://supportcenter.checkpoint.com/supportcenter/portal?eventSubmit_doGoviewsolutiondetails=&amp;solutionid=sk170812&amp;partition=Advanced&amp;product=IPSec" target="_blank" rel="noopener noreferrer">sk170812: <STRONG>Route</STRONG> Based <STRONG>VPN</STRONG> solution for Overlapping Encryption Domains</A></P> Fri, 22 Apr 2022 08:44:45 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146835#M23367 G_W_Albrecht 2022-04-22T08:44:45Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146848#M23371 <P>The NAT solution is really simple. You pick a NAT block for them to use, and they pick a NAT block for you to use. Each side applies the NATs for their own addresses using the NAT block provided by the peer. That way, you always talk with a block of addresses you know don't overlap with anything in our environment, they always talk with addresses which they know don't overlap with anything in their environment. Within the tunnel, it will be the addresses they selected for you and the addresses you selected for them, with no real addresses at all. Works for VPNs or WAN links, and keeps everything unambiguous.</P> Fri, 22 Apr 2022 13:24:05 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146848#M23371 Bob_Zimmerman 2022-04-22T13:24:05Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146962#M23398 <P>This works good for two peers in one community, but tends to go more complicated for every peer added.</P> Mon, 25 Apr 2022 09:21:05 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/146962#M23398 G_W_Albrecht 2022-04-25T09:21:05Z https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/147009#M23417 <P>At least it's a constant complexity overhead per connection to another company. I have about 250 such connections right now, and it's not too bad.</P> Mon, 25 Apr 2022 16:24:37 GMT https://community.checkpoint.com/t5/Firewall-and-Security-Management/Re-internal-subnet-of-a-tunnel-vpn-equal-to-my-internal-subnet/m-p/147009#M23417 Bob_Zimmerman 2022-04-25T16:24:37Z