I need help writing NAT rule for this use case: I want to be able to connect to an local IP as though it's the remote server IP. e.g. port forwarding.
I don't have access to the firewall on the remote network and the server is on the other side of that. See map
So ideally if a client on 10.99.0.0/24 accesses say 10.100.0.129 it would translate to 192.168.50.129 and back again. 192.168.50.129 doesn't access the clients directly. VPN tunnel is up and functioning.
I've tried (with subnet and host objects but I didn't want to jumble this example up with a bunch of unnecessary lines)
nat (inside,outside) source static 10.99.0.0/24 10.100.0.129 destination static 192.168.50.129 192.168.50.129
but that was a no go.
On the vendor firewall the rule would likely be (whatever the Palo Alto version of this is):
nat (inside,outside) source static 192.168.50.128/25 192.168.50.128/25 destination static 10.100.0.0/24 10.100.0.0/24
What am I doing wrong?
---- EDIT ----
Figured it out.
Added the server IP (192.168.50.129) to the interesting traffic for Spoke A <-> Hub tunnel.
Added this NAT rule to my hub:
object network LocalServerIP
host 10.100.0.129
object network RemoteServerIP
host 192.168.50.129
nat (outside,outside) source dynamic any LocalServerIP destination static RemoteServerIP RemoteServerIP
10.100.0.0/24
network to10.100.0.129
would be sent directly from the source host to the destination host on the same network. Unless the destination address exists on the same network, the attempt will fail.