I'm not a real network engineer (just something I must dabble in from time to time), so hopefully I will provide enough detail and use the right terminology here.
We have a site-to-site VPN requirement with a data partner. We have a NSA 2600 and they have a Cisco ASR1004. They require that our "Encryption Domain" (in sonicwall terms "Local Network") be a public IP address.
We currently use all of our available public IP addresses for incoming and outgoing traffic of various types, so, for the first pass, we randomly chose one to give it. Lets call it "Fiber19" (that is what our address object is called) and their "remote encryption domain" (aka "Destination Network") is called "Incomm IP - Test" and is a public IP of theirs that they are using within the tunnel. Note that "Fiber19" is not the first IP address in our WAN block, it is the second. Although the WAN interface is using "Fiber18" as its IP, it still accepts traffic for "Fiber19" for various services (I'm not sure exactly how this works, but we're glad that it does).
The "Interesting traffic" that we want to travel over this tunnel is requests originating from a specific subnet of ours on a single service (port) that will not overlap with any other services. All requests will originate from our network, but must NAT to appear that they are from that "Fiber19" address. It will all go to a single IP on their end.
Now, the questions I have are as follows:
- Will having that public IP assigned to the tunnel cause any issues with routing, NAT, etc.? Should we just poach some foreign ISPs DHCP IP to use in this tunnel, to avoid promiscuity or any other IP overlap?
- How can I set up NAT to send all of this single port traffic through this tunnel to their endpoint? I've looked at using "Apply NAT Policies" in the VPN advanced settings, but it doesn't seem like a good fit for this application, or at least i don't know how to configure it to do this.
Note: we currently have the VPN connected, and I'm not seeing any IP issues, currently, but I don't know what will happen once I figure out how to route traffic to it.
Thanks in advance for any advice, and I hope this all makes sense to someone.