topic Re: IPSec with NAT in Firewall and Security Management

IPSec with NAT

gemechisd — Tue, 19 Dec 2023 13:44:14 GMT

We have a checkpoint security gateway with R81.10 JHF 110 Installed. And we have established a Site to Site IPSec VPN with one partner having Fortigate Firewall. On the established IPSec tunnel we have 3 different Encryption Domains for different services. The third party wants our encryption domains to be natted to an IP Address they gave us. We have done the nat of our local encryption domains for the 3 services with different NAT IP's. And we can reach 2 services to the Remote destination / Encryption Domain, but we can't reach 1 service on the remote ED. All three services are on the same IPSec VPN Tunnel.

Why is 2 services with Natted IP's worked and 1 service is not working for us?

Re: IPSec with NAT

the_rock — Tue, 19 Dec 2023 14:02:36 GMT

K, so sounds like config is fine. If one is failing, maybe do basic VPN debug and also check vpnd.elg files as well for that service. Out of curiosity, what service is it? Make sure its not expluded in the excluded services tab on the community options as per below.

Andy

Re: IPSec with NAT

gemechisd — Sun, 24 Dec 2023 06:17:30 GMT

@the_rock Thank you for the reply.

One thing to keep in mind, the service worked/reachable when we allow server to server without NAT on the Encryption Domain. But with NAT it will not work.

Below you will the excluded services screenshot form the community.

Re: IPSec with NAT

the_rock — Sun, 24 Dec 2023 12:42:28 GMT

Might be worth TAC case to double check.

Best,

Andy

Re: IPSec with NAT

PhoneBoy — Tue, 26 Dec 2023 18:41:01 GMT

What are the precise details of the NAT you've configured on your end, working and non-working?
Possible this is an issue on the remote end.