topic Question regarding NAT behavior with VPN in Firewall and Security Management

Question regarding NAT behavior with VPN

ianhunter — Mon, 10 Jun 2024 17:32:10 GMT

Hello,

I have a question regarding NAT behavior in relation to IPSEC tunnels. Consider this scenario:

FW1 -> FW2 (through IPSEC VPN)

Policy on FW1 ---

Source: HostObj1 (host object with private IP, NAT to public IP - automatic NAT rule created)

Destination: HostObj2, HostObj3, ...

VPN: MyCommunity1

Action: Accept

---

My question, will source NAT apply to this traffic since VPN involved? If not, is there any setting that controls this or documentation that supports it?

Thanks in advance.

Re: Question regarding NAT behavior with VPN

PhoneBoy — Fri, 14 Jun 2024 23:45:11 GMT

Yes, source NAT will apply.

Re: Question regarding NAT behavior with VPN

the_rock — Fri, 14 Jun 2024 23:55:13 GMT

Just make sure NAT setting is NOT disabled inside vpn community object.

Andy

Re: Question regarding NAT behavior with VPN

ianhunter — Sun, 16 Jun 2024 17:07:46 GMT

Thanks! So if I understand correctly, source NAT will apply unless this is set?

Re: Question regarding NAT behavior with VPN

the_rock — Sun, 16 Jun 2024 17:14:46 GMT

Thats right!

Andy

Re: Question regarding NAT behavior with VPN

the_rock — Sun, 16 Jun 2024 17:16:14 GMT

VPN Communities - Advanced (checkpoint.com)

Disable NAT Inside the VPN Community

Even if NAT is configured it is possible to disable NAT inside the VPN community. If NAT is disabled, when a host behind a community member opens a connection with another host behind a community member, the original IP addresses are used. Other connections use the translated address.