Important note about SSL VPN compatibility for 20.0 MR1 with EoL SFOS versions and UTM9 OS. Learn more in the release notes.

NAT over 2 VPN Connections

See the image below for the layout.  Users behind the Meraki firewall need to reach the server behind the ASA firewall by traversing the Site2Site network between the Meraki and XG, then over the Site2Sit between the XG and ASA.

We know it's possible if we include the Meraki LAN in the config between the XG and ASA, but we would like to avoid that, if possible, for several reasons.  

I tried setting up NAT based on these instructions:

https://docs.sophos.com/nsg/sophos-firewall/20.0/Help/en-us/webhelp/onlinehelp/AdministratorHelp/SiteToSiteVPN/HowToArticles/S2sVPNIPsecCreateIPsecRouteNAT/index.html

In my case, instead of the remote network needing to reach the Head Office DMZ, it needs to reach a network that is across another Site2Site VPN, but it's not working.  Maybe I set something up wrong or maybe it won't work because there are 2 VPN connections involved?



Added TAGs
[edited by: Raphael Alganes at 3:11 PM (GMT -8) on 9 Jan 2025]