MPLS to IPSEC VPN NATTED TRAFFIC FLOW

[ANANTADSULE]

Dear All,

Please help in below scenario.

Vendor1
Vendor1 Node IP-11.246.0.202
Router MPLS WAN IP - 11.139.3.102
MPLS Gateway-11.139.3.101

Vendor1 Connected to Checkpoint Quantam Spark 1550 only through MPLS link

Quantam Spark 1550
MPLS WAN IP-11.139.3.218
MPLS Gateway -11.139.3.217
LAN-10.10.10.0/24
Local encryption Domain
10.10.10.0/24
WAN IP-1.1.1.1

Remote encryption Domain
172.116.0.0/24
WAN IP-2.2.2.2

Checkpoint Quantam Spark 1550 connected through IPsec VPN only to Vendor2 using PFsense community UTM

Vendor2
Vendor2 Node IP-172.116.0.206
LAN-172.116.0.0/24
WAN IP-2.2.2.2

Remote encryption Domain
10.10.10.0/24
WAN IP-1.1.1.1

Vendor1 needs to connect Vendor2 node 172.116.0.206 using NATTED IP 11.4.101.250

[PhoneBoy]

As far as I know, you should be able to create a regular NAT rule to achieve this (under Access Policy > Firewall > NAT).

[ANANTADSULE]

NAT rule is defined

Original Source -11.246.0.202 Original Destination(NATTED IP)-11.4.101.250 Service-9891 Translated Source-Original Translated Destination-172.116.0.206 and reverse NAT

Vendor 1 trying to initiate the traffic,but no logs found on Checkpoint and traceroute reached till Checkpoint MPLS WAN IP--11.139.3.218 only.

[PhoneBoy]

Vendor 1 is only connected via an MPLS link (no VPN), correct?
Their IP address(es) will have to be included in the encryption domain on the 1550, otherwise it will not put the traffic through the VPN at all.
The PFsense configuration will likely also need adjusting.

[ANANTADSULE]

Traffic silently droped

Packet captured below 

IP 11.246.0.202.29787 > 11.4.101.250.9851: tcp 0

[ANANTADSULE]

Translation is happening now,but actual traffic is not passing to Vendor2

[PhoneBoy · Accepted solution]

The gateway will only encrypt traffic from a given source if it is listed in the Encryption Domain.
Sounds like you haven't added 11.246.0.202 to the Encryption Domain on the 1550.
This will likely require configuration changes on the other end unless you also NAT the source IP to something within the existing Encryption Domain.

[ANANTADSULE]

It worked👍

Thank you