Thread Info
  • State Verified Answer
  • +1 person also asked this people also asked this
  • Locked Locked
  • Replies 3 replies
  • Subscribers 27 subscribers
  • Views 1618 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IPSEC tunnel and policy NAT

Jon M

I am coming from a Cisco firewall background so hopefully this makes sense. 

 

I have a number of site to site VPN tunnels where the local LAN is 172.16.1.0/24. For just one of those tunnels I need to present just one IP - 172.16.1.10 to the remote end but it needs translating to a different IP eg. 172.16.22.10. This NAT should only effect this tunnel and nothing else.  The remote end is a Cisco firewall. 

 

The connection is initiated from the Cisco end to the 172.16.22.10 IP. 

 

I have got the VPN tunnel up and running using this guide - https://community.sophos.com/kb/en-us/123356 and if I ping from the Sophos end I can ping a host behind the Cisco firewall. But what I can't do is ping 172.16.22.10 from the Cisco end. 

 

If this was a Cisco firewall I would create a static policy NAT statement for the 172.16.22.10 IP so in effect the 172.16.1.10 IP is only translated to the 172.16.22.10 IP for this specific tunnel. 

So my question is, should what I am trying to do work using the above document or do I need to create a static policy NAT statement on the Sophos and then use that in the VPN setup ? 

 

Many thanks 



This thread was automatically locked due to age.
Parents
  • 0

    Quick update on this - 

     

    I changed the VPN configuration so the local subnet was simply 172.16.22.10 and I then created a DNAT firewall rule where - 

     

    Source zone = VPN 

    Allowed client networks = 172.16.7.0/24 

     

    Destination & Service = 172.16.10.22 

    Services = any 

     

    Forward to = 172.16.1.10 

    Protected Zone = LAN 

     

    Create reflexive rule is set to on 

     

    I can now ping 172.16.22.10 from the remote side which is good but I cannot ping 172.16.7.10 at the remote side from Sophos end. 

     

    Do I also need to setup a source NAT or is there a much simpler way to do this. 

Reply
  • 0

    Quick update on this - 

     

    I changed the VPN configuration so the local subnet was simply 172.16.22.10 and I then created a DNAT firewall rule where - 

     

    Source zone = VPN 

    Allowed client networks = 172.16.7.0/24 

     

    Destination & Service = 172.16.10.22 

    Services = any 

     

    Forward to = 172.16.1.10 

    Protected Zone = LAN 

     

    Create reflexive rule is set to on 

     

    I can now ping 172.16.22.10 from the remote side which is good but I cannot ping 172.16.7.10 at the remote side from Sophos end. 

     

    Do I also need to setup a source NAT or is there a much simpler way to do this. 

Children