topic Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW in Spark Firewall (SMB)

MPLS to IPSEC VPN NATTED TRAFFIC FLOW

ANANTADSULE — Tue, 03 Feb 2026 07:02:10 GMT

Dear All,

Please help in below scenario.

Vendor1
Vendor1 Node IP-11.246.0.202
Router MPLS WAN IP - 11.139.3.102
MPLS Gateway-11.139.3.101

Vendor1 Connected to Checkpoint Quantam Spark 1550 only through MPLS link

Quantam Spark 1550
MPLS WAN IP-11.139.3.218
MPLS Gateway -11.139.3.217
LAN-10.10.10.0/24
Local encryption Domain
10.10.10.0/24
WAN IP-1.1.1.1

Remote encryption Domain
172.116.0.0/24
WAN IP-2.2.2.2

Checkpoint Quantam Spark 1550 connected through IPsec VPN only to Vendor2 using PFsense community UTM

Vendor2
Vendor2 Node IP-172.116.0.206
LAN-172.116.0.0/24
WAN IP-2.2.2.2

Remote encryption Domain
10.10.10.0/24
WAN IP-1.1.1.1

Vendor1 needs to connect Vendor2 node 172.116.0.206 using NATTED IP 11.4.101.250

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

PhoneBoy — Tue, 03 Feb 2026 19:04:38 GMT

As far as I know, you should be able to create a regular NAT rule to achieve this (under Access Policy > Firewall > NAT).

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

ANANTADSULE — Wed, 04 Feb 2026 06:09:35 GMT

NAT rule is defined

Original Source -11.246.0.202 Original Destination(NATTED IP)-11.4.101.250 Service-9891 Translated Source-Original Translated Destination-172.116.0.206 and reverse NAT

Vendor 1 trying to initiate the traffic,but no logs found on Checkpoint and traceroute reached till Checkpoint MPLS WAN IP--11.139.3.218 only.

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

ANANTADSULE — Wed, 04 Feb 2026 07:32:49 GMT

Traffic silently droped

Packet captured below

IP 11.246.0.202.29787 > 11.4.101.250.9851: tcp 0

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

PhoneBoy — Wed, 04 Feb 2026 15:13:19 GMT

Vendor 1 is only connected via an MPLS link (no VPN), correct?
Their IP address(es) will have to be included in the encryption domain on the 1550, otherwise it will not put the traffic through the VPN at all.
The PFsense configuration will likely also need adjusting.

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

ANANTADSULE — Thu, 05 Feb 2026 10:12:07 GMT

Translation is happening now,but actual traffic is not passing to Vendor2

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

PhoneBoy — Thu, 05 Feb 2026 17:03:48 GMT

The gateway will only encrypt traffic from a given source if it is listed in the Encryption Domain.
Sounds like you haven't added 11.246.0.202 to the Encryption Domain on the 1550.
This will likely require configuration changes on the other end unless you also NAT the source IP to something within the existing Encryption Domain.

Re: MPLS to IPSEC VPN NATTED TRAFFIC FLOW

ANANTADSULE — Tue, 10 Feb 2026 10:18:19 GMT

It worked👍

Thank you