3

I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal network. I would prefer to not reveal my office network to the other side, suggesting NAT. (All IPs fake.)

     -----------
  --/           \--          +--------------+
 /                 \     /---+              |
(   11.11.11.0/16   )----    | 11.11.11.1   |
 \                 /         +------==------+
  --\           /--              === 
     -----------              ===             MY OFFICE
     CLIENT        Internet ==              -----------
                         ===             --/           \--
                      ===               /                 \
             +------==-------+      /--(    10.1.1.0/24    )
             |               |  /---    \                 /
             | 22.22.22.1/30 +--  NAT    --\           /--
             +---------------+              -----------

For this, it seems that I could connect from (say) 10.1.1.23 to 11.11.11.45, and yet the "11." network sees all connections from 22.22.22.1. I have a single-address static subnet (22.22.22.1/30), so I believe I can set my encryption domain to 22.22.22.0/30 and use NAT on my end. (The remote end is not using NAT.)

My understanding from https://networkengineering.stackexchange.com/a/45107/43748 is that NAT has a slight penalty to it (not a surprise), but it does not say that it cannot be done. https://networkengineering.stackexchange.com/a/41503 suggests NAT can be used to solve problems with overlapping subnet ranges. Both (and others) tell me that NAT in a site-to-site configuration can be fine.

But the remote side admins "insist" that they must know my office internal subnet to properly function. I think all they need to know for my encryption domain is 22.22.22.0/30, encryption gateway 22.22.22.1, with no internal network defined.

What is my misunderstanding wrt this network topology?

(The specific models, if it matters: my end CheckPoint-790; remote ends are either Cisco ASA or SonicWall, depending on the client.)

  • 1
    NAT is simply changing (translating) addresses in an IP packet. It doesn't really do anything for security. What provides you security is a firewall, and you can configure the firewall to deny or allow whatever you want to allow or deny. – Ron Maupin Feb 12 '18 at 19:38
  • Good point, perhaps I should focus my security efforts on rejecting new packets from 11.*/16 to 10.*/24. Great point, actually. Though I still don't feel they need to know anything about my internal network, including the subnet: security-by-obscurity should never be relied on, but it still has a net-positive effect as a layer on top of other (strong) security techniques. – r2evans Feb 12 '18 at 20:24
4

If one site has the internal address space of 11.11.0.0/16 and the other has 10.1.1.0/24, then technically you do not have Overlapping networks on either side of the VPN tunnel.

If you want the 11.11.0.0/16 network to speak directly to the 10.1.1.0/24 network, then you don't need any type of NAT.

If you want the 11.11.0.0/16 network to speak to another network, but have that other network be translated to 10.1.1.0/24, then you would need to set up a Policy NAT.

For example, if you wanted to hide the 10.1.1.0/24 network as the 22.1.1.0/24 network, you would set up a Policy NAT on the Router/Firewall on the 10.1.1.0/24 network that essentially says:

When 10.1.1.0/24 is speaking to 11.11.0.0/16, translate the 10.1.1.0/24 network to 22.1.1.0/24.

You could use either a Static NAT if you want each IP in the 10.1.1.0/24 to map to something unique in the 22.1.1.0/24 network. Or you could use a Dynamic PAT if you want the entire 10.1.1.0/24 network to appear as a single address (aka 22.1.1.200).

Either way, the OTHER side will only need to know about the 22.1.1.x network -- they will NOT have to know about your internal 10.1.1.0/24 network.

  • 1
    Thank you for confirming that I can use NAT on this site-to-site, and the other side only needs to know about the 22.*/30 network. I feel like I'm going crazy sometimes dealing with different admins projecting preference and assumptions over topological requirements. – r2evans Feb 12 '18 at 19:57
  • @r2evans, remember that NAT breaks some protocols and applications, and there may be a legitimate requirement to not use NAT. – Ron Maupin Feb 12 '18 at 20:03
  • 1
    I know some things break with NAT, but none of my current network needs would: ssh, sql, et al. Thanks, it's important to keep that in mind. – r2evans Feb 12 '18 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.