0

I have created a ipsec VPN from site A (Cisco) to Site B (checkpoint R77.20). At site B, i have a static 1-1 NAT applied: ipx --ipy

Tunnel is live and connection up; I can telnet my site B system from site A; but unable to telnet site A system from Site B.

So I checked the Checkpoint firewall at site B, found traffic from ipy is passing through firewall policy, not VPN policy ; also not being source NAT to ipx.

So does a policy based VPN require any static routing in checkpoint? Any specific reason for source NAT policy not working?

Improve this question
6
  • If you have a VPN, why are you using NAT? You tunnel to avoid NAT, which you really want to avoid if at all possible. Without NAT, you can use a routing protocol and avoid static routing, otherwise you would need to put in static routes.
    – Ron Maupin ♦
    Commented Aug 27, 2019 at 19:03
  • Using NAT to avoid LAN subnet overlap. But my concern is source NAT is not working!!
    – Subin Thomas
    Commented Aug 27, 2019 at 19:06
  • Traffic hits firewall policy.. no hits on vpn policy..
    – Subin Thomas
    Commented Aug 27, 2019 at 19:07
  • You use outside-source NAT for overlapping networks, but it should only be a temporary solution until you can readdress one side or the other. Merging companies do this until the address overlap is fixed, but it should never be a permanent solution, and you really want to get to the point you can use a routing protocol because static routes do not scale. There questions here about overlapping networks, for example, this one,
    – Ron Maupin ♦
    Commented Aug 27, 2019 at 19:12
  • I have no issue when I use Cisco at my client side. And I use 1-1 Nat; in Cisco i use ' ip Nat inside source static' and that handles NAT in both direction. Is it possible to do same kind of configuration in Checkpoint?
    – Subin Thomas
    Commented Aug 27, 2019 at 19:20

1 Answer 1

Reset to default
0

We found the issue: When SNAT is applied on VPN, we need to add both real IP and NAT IP in local network in the tunnel. Only then SNAT rule works in LAN to VPN traffic.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.