Nat inside VPN tunnel to Fortigate

[nooni]

Hi

I am trying to do NAT translation inside the VPN tunnel and i cant wrap my head around this configuration.

The topology looks like this:

In the Encryption Domain on the Check Point i have 192.168.18.10 and 192.168.20.0/28

So server 192.168.18.10 should communicate with 10.10.13.1, which in turn is translated on the Fortigate side to 10.10.12.10.

First issue, Check Point will not route packet over VPN tunnel when i have 192.168.20.0/28 in the EncDom.

If i put 192.168.20.0/28, which i did for a test the phase2 fails, because of course this net is not on the other side really.

NAT is enabled in the community.

I need some suggestions on how to think here

[CaseyB]

I believe this is the NAT rule you are looking for if I am following you correctly.

[nooni]

I would like the 192.168.18.10 server communicate with IP address 192.168.20.1 and not directly with 10.10.13.1 therefore the NAT table looks a bit weird. 

So SRC 192.168.18.10 sends traffic to IP 192.168.20.1 and then this traffic gets translated to 10.10.13.1 so i do not have to use 10.10.13.1 in my local network

[CaseyB]

The firewall needs to have a route for 192.168.20.1 somewhere if you want it to be a destination, so it would have to be in the encryption domain on the Fortigate side, but then you'd be doing the NAT translation on the Fortigate side.

What problem are you trying to solve here?

[Lesley]

you need to change the source ip in the nat rule also as stated before. 

the 192.168.20.1 is floating IP and should be attached to fw with proxy arp. 

both real local ip range + local NAT pool should be in local encr domain. You only need to add NAT pool of fortigate in remote peer enc domain, no need for you to know the real ip range there. 

[nooni]

Thanks, so 192.168.20.1 should be manually configured on each FW in the cluster, with the external as interface then ?

[Lesley]

No see it as floating IP, it does not have to be directly configured on the interface. 

With proxy arp firewall will reply if traffic comes in with arp reply. Make the fw aware the floating IP belongs to the firewall. Just like you would do with public NAT if the IP range is routed to the fw and not directly configured on the interface. 

[nooni]

So i used the static nat function in the NAT object that should be sufficient.

So the manual NAT rule should look like this ?

Orig SRC 192.168.18.1 Orig DST 192.168.20.1 translated dst 10.10.13.1 ?

[the_rock]

That looks right.

[nooni]

Hi

Can you clarify a bit how the proxy arp should look like ?

[the_rock]

https://support.checkpoint.com/results/sk/sk30197

[nooni]

Yes i have seen that one but what interface should this translated IP being attached to ?

[the_rock]

Most likely external.

[the_rock]

I believe what Lesley suggested makes sense.