Site_to_site VPN Connection - same subnet at both ends - IpSEC Nat Settings

Question

Hello, 
 I' trying to configure "Nat Settings" (see image for example) inside the configuration of a Site_to_site ipsec vpn. 
 I have two separated subet in my network 192.168.1.x/24 and 192.168.21.x/24 and I would like that both subnet, inside the vpn, are NATed to 192.168.129.x/24 (Local_NATed_LAN). 
 It works only using subnet with same cidr range (for example 192.168.1.0 /24 NATed with 192.168.129.0/24). If I try using 192.168.0.0/16 as SF1_LAN (to include both subnets) nothing works. 
 Is it the right behaviour? 
 
 Thanks

Sreenivasulu Naidu · Accepted Answer

While configuring the NAT (in IPsec config), when mouse pointed on Network Address Translation (NAT), a pop-up is seen saying that subnet should be same for original and translated networks.

Differing original and translated subnets will result in data traffic dropped by firewall. 
 
 Ensure to have either same subnets for original and translated or keep individual subnets (not the summarized ones) and have two different NAT translations one for each subnet.

Sreenivasulu Naidu · Answer

Hi @ Gianluca Maistri , when the IPsec gateways' local subnets are different, why do you want to NAT them to to a single subnet? 
 NAT option given in the IPsec config page is meant for this use case: when both IPsec gateways has same LAN subnet, it is not possible to bringup IPsec s2s tunnel; using NAT option, the local subnet on one IPsec gateway (say gateway1) is translated to a new subnet (say subnet1) and on another IPsec gateway's (say gateway2) local subnet is translated into a new subnet (say subnet2) and now local and remote subnets are different and it helps bringing up IPsec s2s tunnel.

Site_to_site VPN Connection - same subnet at both ends - IpSEC Nat Settings

Top Replies