Thread Info
  • State Verified Answer
  • Locked Locked
  • Replies 4 replies
  • Subscribers 38 subscribers
  • Views 2216 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

XG firewall V18 source nat in ipsec tunnel

Luc_GLLM

HI to all,

i have this situation:

LAN 1:192.168.100.0/24

LAN 2: 192.168.200.0/24

LAN 3: 192.168.234.0/24

SSL VPN pool: 192.168.90.0/24

IPsec site-site: local subnet 192.168.234.0 remote subnet 10.11.10.0/24

ipsec tunnel works fine, hosts in subnet 192.168.234.0 manage to reach remote site 10.11.10.0.

Now a request has been made to me, also the hosts in the other LAN networks and in the SSL pool must be able to communicate with the remote site, the problem is that on the other side (remote site) no changes can be made, so I cannot simply include the other subnets in the ipsec tunnel. I think the only way is to do NAT.

Directly from the ipsec configuration I can flag the NAT option and add another network and it works, the problem is that I can only put one network, and it does not accept a network group.

So I thought about doing a NAT source from NAT roules, but that doesn't work.
The source NAT I configured it like this:

Origianl source: I put in all the LAN networks and SSL pools that interested me

Original destination: 10.11.10.0/24 (remote subnet)

Original Service: ANY

Transalted source: MASQ 

Translated destination: original

Translated serice: original

Inbound interface: ANY

Outbound interface: 192.168.234.2(LAN port included in IPsec tunnel)

what am I doing wrong?



Edited TAGs
[edited by: emmosophos at 5:28 PM (GMT -7) on 2 Jun 2021]
Parents
  • 0

    IPsec does not support "MASQ", as you do not have a interface to NAT to. MASQ will use the Interface IP. 
    Use translated source: IP Host and create a host, existing in the tunnel / accepted by the other peer. 

    __________________________________________________________________________________________________________________

  • 0 in reply to LuCar Toni

    I had also tried this solution but it doesn't work

    Origianl source: I put in all the LAN networks and SSL pools that interested me

    Original destination: 10.11.10.0/24 (remote subnet)

    Original Service: ANY

    Transalted source: 192.168.234.20 (host reachable by other peer) 

    Translated destination: original

    Translated serice: original

    Inbound interface: ANY

    Outbound interface: 192.168.234.2(LAN port included in IPsec tunnel), i have tried also with ANY.

     

Reply
  • 0 in reply to LuCar Toni

    I had also tried this solution but it doesn't work

    Origianl source: I put in all the LAN networks and SSL pools that interested me

    Original destination: 10.11.10.0/24 (remote subnet)

    Original Service: ANY

    Transalted source: 192.168.234.20 (host reachable by other peer) 

    Translated destination: original

    Translated serice: original

    Inbound interface: ANY

    Outbound interface: 192.168.234.2(LAN port included in IPsec tunnel), i have tried also with ANY.

     

Children
  • FormerMember
    +1 FormerMember in reply to Luc_GLLM

    Hi ,

    You may also need to add an IPsec route for 10.11.10.0/24 destination network to forcefully route the traffic coming from other LAN/SSL networks.

    Login to SSH > 4. Device console

    console> system ipsec_route add net 10.11.10.0/255.255.255.0 tunnelname <ipsec_tunnel_name>

    ==> Set up a NAT rule with the below parameters.

    Original source: I put in all the LAN networks and SSL pool
    Original destination: 10.11.10.0/24 (remote subnet)
    Original Service: ANY
    Translated source: 192.168.234.2 LAN interface IP address(You can also use any other IP from 192.168.234.0/24 network)
    Translated destination: Original
    Translated service: Original
    Inbound interface: ANY
    Outbound interface: ANY

  • 0 in reply to FormerMember

    Perfect thank you.

    Adding the ipsec route the snat work well!

Unfiltered HTML