I am connecting my office to a client's network via IPSec. The need is for me to connect directly to internal IPs on their network; there is no need for them to connect to any services on my internal network. I would prefer to not reveal my office network to the other side, suggesting NAT. (All IPs fake.)

  --/           \--          +--------------+
 /                 \     /---+              |
(   )----    |   |
 \                 /         +------==------+
  --\           /--              === 
     -----------              ===             MY OFFICE
     CLIENT        Internet ==              -----------
                         ===             --/           \--
                      ===               /                 \
             +------==-------+      /--(    )
             |               |  /---    \                 /
             | +--  NAT    --\           /--
             +---------------+              -----------

For this, it seems that I could connect from (say) to, and yet the "11." network sees all connections from I have a single-address static subnet (, so I believe I can set my encryption domain to and use NAT on my end. (The remote end is not using NAT.)

My understanding from https://networkengineering.stackexchange.com/a/45107/43748 is that NAT has a slight penalty to it (not a surprise), but it does not say that it cannot be done. https://networkengineering.stackexchange.com/a/41503 suggests NAT can be used to solve problems with overlapping subnet ranges. Both (and others) tell me that NAT in a site-to-site configuration can be fine.

But the remote side admins "insist" that they must know my office internal subnet to properly function. I think all they need to know for my encryption domain is, encryption gateway, with no internal network defined.

What is my misunderstanding wrt this network topology?

(The specific models, if it matters: my end CheckPoint-790; remote ends are either Cisco ASA or SonicWall, depending on the client.)

  • 1
    NAT is simply changing (translating) addresses in an IP packet. It doesn't really do anything for security. What provides you security is a firewall, and you can configure the firewall to deny or allow whatever you want to allow or deny.
    – Ron Maupin
    Commented Feb 12, 2018 at 19:38
  • Good point, perhaps I should focus my security efforts on rejecting new packets from 11.*/16 to 10.*/24. Great point, actually. Though I still don't feel they need to know anything about my internal network, including the subnet: security-by-obscurity should never be relied on, but it still has a net-positive effect as a layer on top of other (strong) security techniques.
    – r2evans
    Commented Feb 12, 2018 at 20:24

1 Answer 1


If one site has the internal address space of and the other has, then technically you do not have Overlapping networks on either side of the VPN tunnel.

If you want the network to speak directly to the network, then you don't need any type of NAT.

If you want the network to speak to another network, but have that other network be translated to, then you would need to set up a Policy NAT.

For example, if you wanted to hide the network as the network, you would set up a Policy NAT on the Router/Firewall on the network that essentially says:

When is speaking to, translate the network to

You could use either a Static NAT if you want each IP in the to map to something unique in the network. Or you could use a Dynamic PAT if you want the entire network to appear as a single address (aka

Either way, the OTHER side will only need to know about the 22.1.1.x network -- they will NOT have to know about your internal network.

  • 1
    Thank you for confirming that I can use NAT on this site-to-site, and the other side only needs to know about the 22.*/30 network. I feel like I'm going crazy sometimes dealing with different admins projecting preference and assumptions over topological requirements.
    – r2evans
    Commented Feb 12, 2018 at 19:57
  • @r2evans, remember that NAT breaks some protocols and applications, and there may be a legitimate requirement to not use NAT.
    – Ron Maupin
    Commented Feb 12, 2018 at 20:03
  • 1
    I know some things break with NAT, but none of my current network needs would: ssh, sql, et al. Thanks, it's important to keep that in mind.
    – r2evans
    Commented Feb 12, 2018 at 20:20

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.