Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 1 reply
  • Answers 1 answer
  • Subscribers 26 subscribers
  • Views 3153 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSEC - Masquerade/NAT 4 Hosts Behind Peer IP

NateP

Ok, something that I've easily done many times on all of our UTMs.  I have a new IPsec tunnel I built to a 3rd party.  We are just accessing a single remote (198.0.0.2/32) host configured in the tunnel, but it needs to be accessed from 4 different hosts on our side.  For our "Local Subnet" I need to use our Public/Peer IP (40.1.1.1).  How would I go about creating SNAT so each of these 4 hosts source IPs are rewritten as the public/peer IP of our device and then encapped into the tunnel?

I was able to add the single local subnet of our 40.1.1.1/32 peer, and NAT to the private IP (10.1.1.2) of one of the servers and it worked great.  How do I go about getting the NAT setup so the other 3 servers can talk too?  Looking for help... Is this a Firewall Rule or Business Rule, advanced-firewall? (never understood the need to have separate routing and firewall in the CLI only.  What a mess.



This thread was automatically locked due to age.
Parents
  • 0

    Got it figured out.  My brain wasn't firing on all cylinders earlier and I put one of the source hosts in the ipsec_route which dropped my connection to it.  The resulting config looks something like this.

    Tunnel: Local 40.1.1.1 / Remote 198.0.0.2

    Firewall:  Source 10.1.1.2 .. .5, Dest 198.0.0.2 NAT to 40.1.1.1

    ipsec_route: dest 198.0.0.2 tunnelname <tun_name>

Reply
  • 0

    Got it figured out.  My brain wasn't firing on all cylinders earlier and I put one of the source hosts in the ipsec_route which dropped my connection to it.  The resulting config looks something like this.

    Tunnel: Local 40.1.1.1 / Remote 198.0.0.2

    Firewall:  Source 10.1.1.2 .. .5, Dest 198.0.0.2 NAT to 40.1.1.1

    ipsec_route: dest 198.0.0.2 tunnelname <tun_name>

Children
No Data