topic VPN Source NAT subnet and actual in same Encryption domain in General Topics

VPN Source NAT subnet and actual in same Encryption domain

Markus_Hoyer1 — Tue, 07 Aug 2018 10:42:32 GMT

Hi Checkmates!

I have a question regarding VPN. On a VSX platform in a single domain on a single Virtual System I am trying to establish a VPN, where we are source NAT'ing in our end and they are aswell.

I can establish Phase 1 and 2 without issues and I can tell that the VPN is establishing with the correct NAT'ed subnet, yet we're not able to send traffic through.

Does this cause an issue if we have both the actual subnet and NAT'ed subnet in the VPN domain manually defined on the VS?

kind regards

hope you can help.

Re: VPN Source NAT subnet and actual in same Encryption domain

Kaspars_Zibarts — Tue, 07 Aug 2018 12:03:00 GMT

What do logs say? Drop on last rule or something else? How is your rule set up?

Re: VPN Source NAT subnet and actual in same Encryption domain

Vladimir — Tue, 07 Aug 2018 20:31:09 GMT

Do you have two manual NAT rules created for egress and ingress of the traffic coming from or destined to the VPN peer?

Re: VPN Source NAT subnet and actual in same Encryption domain

Markus_Hoyer1 — Wed, 08 Aug 2018 09:24:49 GMT

Yes we have two manual NAT's for both egress and ingress.

Yesterday in the maintenance window we got the VPN up and running, we didn't do any changes, the issue was the ruleset in the other end.

The logs translated correctly as intended.

I was just curious towards the design of the Checkpoint whether it might cause an issue having both the actual and NAT'ed subnet in the encryption domain.

Thank you both for your replies