Manual NAT For Site-to-site VPN

[Malik1]

Hi Experts,

I have an existing IPSEC tunnel with one of my clients that's working fine. Now I have a requirement and need to translate my source subnet . 

I will add the subnet used for translation in the VPN domain at both ends. and add NAT rule. 

Firewall rules will remain the same as the policy is checked before NAT.

My question is do we create a bi-directional NAT rule, which has been shown in fig below. ? or just the nat rule 1 mentioned in the figure?

Is an automatic reverse NAT rule created?

Regards,

SM

[the_rock]

Looks okay to me. Make sure NAT is NOT disabled in VPN community.

[RS_Daniel · Accepted solution]

Hello,

For traffic initiated from your local network to remote one, only rule 1 is needed, the firewall knows that thre reply packets need to be translated to the original source.

Your second rule is enabling traffic initiated from the remote network to your local network to be translated to the real host.

So it depends if traffic will be initiated from both sites or only from local to remote? in first case both rules are needed, in second case only the first rule.

Regards