Encryption Domains that are External IPs

[sx8n20394]

Appliance : Locally Managed QS 1535

Firmware r81.10.10

I need to setup a S2S VPN with a customer. They have a requirement that all encryption domains are WAN IP addresses. I have a range of 5 addresses but only 1 is used which is the WAN interface of my firewall. Do I just tell them my peer and encryption domains are x.x.x.x/32 (same IP)? Also, can I safely assume I should uncheck disable NAT in the site tunnel settings?

[PhoneBoy]

Sounds like the right answer on both counts.
Note that your local Encryption Domain should include the hosts that you want to communicate through the VPN.

[the_rock]

If NAT is needed, then dont check disable nat inside vpn community object.

Andy

[the_rock]

Also, dont check option to exclude external IP from vpn domain, its on vpn domain tab under topology or network (cant remember now exactly) when you edit gw object in smart console.

Andy