IPSec site-to-site with/without NAT

Question

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal network. I would prefer to not reveal my office network to the other side, suggesting NAT. (All IPs fake.)

     -----------
  --/           \--          +--------------+
 /                 \     /---+              |
(   11.11.11.0/16   )----    | 11.11.11.1   |
 \                 /         +------==------+
  --\           /--              === 
     -----------              ===             MY OFFICE
     CLIENT        Internet ==              -----------
                         ===             --/           \--
                      ===               /                 \
             +------==-------+      /--(    10.1.1.0/24    )
             |               |  /---    \                 /
             | 22.22.22.1/30 +--  NAT    --\           /--
             +---------------+              -----------

For this, it seems that I could connect from (say) 10.1.1.23 to 11.11.11.45, and yet the "11." network sees all connections from 22.22.22.1. I have a single-address static subnet (22.22.22.1/30), so I believe I can set my encryption domain to 22.22.22.0/30 and use NAT on my end. (The remote end is not using NAT.)

My understanding from https://networkengineering.stackexchange.com/a/45107/43748 is that NAT has a slight penalty to it (not a surprise), but it does not say that it cannot be done. https://networkengineering.stackexchange.com/a/41503 suggests NAT can be used to solve problems with overlapping subnet ranges. Both (and others) tell me that NAT in a site-to-site configuration can be fine.

But the remote side admins "insist" that they must know my office internal subnet to properly function. I think all they need to know for my encryption domain is 22.22.22.0/30, encryption gateway 22.22.22.1, with no internal network defined.

What is my misunderstanding wrt this network topology?

(The specific models, if it matters: my end CheckPoint-790; remote ends are either Cisco ASA or SonicWall, depending on the client.)

Answer 1

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel.

If you want the 11.11.0.0/16 network to speak directly to the 10.1.1.0/24 network, then you don't need any type of NAT.

If you want the 11.11.0.0/16 network to speak to another network, but have that other network be translated to 10.1.1.0/24, then you would need to set up a Policy NAT.

For example, if you wanted to hide the 10.1.1.0/24 network as the 22.1.1.0/24 network, you would set up a Policy NAT on the Router/Firewall on the 10.1.1.0/24 network that essentially says:

When 10.1.1.0/24 is speaking to 11.11.0.0/16, translate the 10.1.1.0/24 network to 22.1.1.0/24.

You could use either a Static NAT if you want each IP in the 10.1.1.0/24 to map to something unique in the 22.1.1.0/24 network. Or you could use a Dynamic PAT if you want the entire 10.1.1.0/24 network to appear as a single address (aka 22.1.1.200).

Either way, the OTHER side will only need to know about the 22.1.1.x network -- they will NOT have to know about your internal 10.1.1.0/24 network.