Hide NAT

Hello Bischof IT Support ,

Thank you for reaching out to the community, please refer the doc - NAT with policy-based IPsec when local and remote subnets are the same.

Hi, already tried this but no success.

we don't have the same subnets:

local subnet:

172.25.169.144/28

remote subnet:

172.25.169.104/29

i should be able to ping the 172.25.169.108 ip address but the remote side didn't see any icmp packets .

i think the packets aren't routed into the vpn tunnel.

thanks

refer - Directing the traffic over the IPsec tunnel

Hi,

You don't need any NAT in IPSec page or system ipsec_route in this case as the local and remote subnets are different.

You should be seeing below child SA on your SFOS1

172.25.169.144/28 (local subnet) === 172.25.169.104/29 (remote subnet).

and on the vice-versa SFOS2.

client1<172.25.169.158/28>---------<172.25.169.145/28>SFOS1-------Tunnel----SFOS2<172.25.169.105/29>-----<172.25.169.110/29>client2

From client1, you should be able to ping 172.25.169.110, the traffic should go via the tunnel. Check you have configured firewall rules on both SFOS nodes correctly.

Hi, thanks, this solved the problem.

But why is this necessary?

I don't have multiple routes to the destination network.

Is the ipsec route still in place when i reboot the firewall?

best regards

Hi,

it only works with the ipsec route.

yes i see the following SA:

child:  172.25.169.144/28 === 172.25.169.104/29 TUNNEL, dpdaction=restart

we are accessing the destination ip from our internal network:

192.168.100.7 --> Hide NAT 172.25.169.145 --> 172.25.169.108

i think i have the correct SNAT Rule, but without ipsec route i didn't get any response from 172.25.169.108.

thanks

best regards

Right, to place the un-connected LAN traffic into the IPSec tunnel, assuming source IP of the un-connected LAN should not be exposed

- NAT (with reflexive rule) needs to be configured.

- Then place the ingress (from LAN) traffic into the concerned IPSec tunnel by configuring system ipsec_route cli.

If it is okay to expose the source IP of the un-connected LAN client, we could even add the un-connected LAN subnet/host into the local subnet of local IPsec gateway and remote subnet/host of remote IPsec gateway.