topic VPN Site-to-Site with NAT in Firewall and Security Management

VPN Site-to-Site with NAT

Bernardes — Mon, 20 Feb 2023 16:33:43 GMT

Hello Mates!

Could you please help me with a question?

I need to configure a Site-to-Site VPN, but for the remote peer (my partner site), a single IP address must arrive and not my entire subnet or subnet group.

For example: I have an 172.16.1.0/24 subnet, but my partner requires that this subnet arrives through the 192.168.1.10 IP.

May I have to put this single IP on VPN domain community by my side? How can I configure that on Check Point solution? And how can I confirm that is working fine?

Thank you!

Re: VPN Site-to-Site with NAT

PhoneBoy — Tue, 21 Feb 2023 15:30:36 GMT

Your encryption domain must include the “traffic to encrypt” which would be your local subnet.
You configure a manual NAT rule to translate your subnet when communicating to their encryption domain to the relevant IP (hide or source NAT depending on requirement).

Re: VPN Site-to-Site with NAT

the_rock — Tue, 21 Feb 2023 16:47:16 GMT

Also, to add to what @PhoneBoy said, make sure option for NAT inside VPN community (I believe last tab on the left at the bottom) is not checked where it says "Disable NAT inside VPN community" and then simply create manual NAT rule to reflect changes you want.

Andy

Re: VPN Site-to-Site with NAT

PhoneBoy — Tue, 21 Feb 2023 17:08:02 GMT

That's an important option that I forget exists...and yet can still recall setting up VPNs in Traditional Mode 🙂

Re: VPN Site-to-Site with NAT

the_rock — Tue, 21 Feb 2023 17:30:35 GMT

No matter what, you are ALWAYS going to be CP guru 🙌

Re: VPN Site-to-Site with NAT

Bernardes — Thu, 23 Feb 2023 00:01:56 GMT

@the_rock @PhoneBoy thank you so much for your help. I can configure successfully the VPN site-to-site with NAT so that the remote site receives just only one IP, no mattering which device was connected on my side.

Re: VPN Site-to-Site with NAT

the_rock — Thu, 23 Feb 2023 12:24:29 GMT

Glad it helped you.

Andy