VPN site to site over SNAT

SNAT has to be used in the IPsec Tunnel with NAT To.

https://community.sophos.com/kb/en-us/123356

Hi LuCar Toni,

my fault, i meant NAT 1:n, in this case you have to create 1 firewall rule, LAN to VPN, and apply masquerading in it and not in IPsec tunnel. Instead if you want NAT 1:1 KB that you provided was ok.

Thank you for you support

You need to apply the same KBA just with a Single SA in the IPsec Tunnel.

It will apply a 1:N NAT (Source NAT).

The Point is, Firewall Rules cannot apply NAT in IPsec Tunnels (right now). 

• The sample scenario in this article shows a 1:1 NAT. Depending on the network requirements, it is also possible to configure a 1:n NAT (SNAT) or a Full NAT.