Hi guys,
I have a question about VPN ending behind NAT. We would like to use Route-based VPN. We have two remote sites each with its own management. On one site we have a CP appliance directly with its own public IP.
On the other side first there is edge router with its public IP lets say 1.2.3.4, this router is doing static NAT, behind this router there is a CP firewall which have IP statically NATed to lets say 10.10.10.10.
With route based VPN we created VTIs each with it's own IP attached to physical interface as stated in the documentation.
Route Based VPN (checkpoint.com)
"
You configure a local and remote IP address for each numbered VPN Tunnel Interface (VTI).
For each Security Gateway, you configure a local IP address, a remote address, and the local IP address source for outbound connections to the tunnel.
The remote IP address must be the local IP address on the remote peer Security Gateway.
More than one VTI can use the same IP Address, but they cannot use an existing physical interface IP address.
"
Now as the router is doing NAT to 10.10.10.10, how should I configure VPN on first site so it knows there is a NAT on remote site and to send traffic via VPN tunnel to public IP 1.2.3.4 and then 2.2.3.4 if both interfaces are on same physical interface?
thanks
