topic Re: Nat exception for VPN on FTD in Network Security

Nat exception for VPN on FTD

orkhan.rustamli.96 — Tue, 12 Mar 2019 11:16:43 GMT

Hello, everyone. I nee clarification about one thing. We are using FTD devices on out corporate network for RA ans S2S VPNs. FTD has one interface for internet and one WAN interface leased from SP for 3rd Party companies. Currently we have one site-to-site vpn with another company. The problem is that IPsec configurations are okay but internal endpoint cannot see each other until i make NAT exception for them. I do know understand why i need exception when i do not have any other NAT configured on that WAN interface. Only lots of Exceptions. Other Internet NAT cons are facing other internet interface. Is there any point forcing me making exceptions for VPNs?

thank in advance!

Re: Nat exception for VPN on FTD

Abheesh Kumar — Mon, 03 Dec 2018 09:47:11 GMT

Hi,
VPN traffic required NAT exception because you may be PAT your internal subnets or 0.0.0.0 to the internet facing interface for the internet access. so the traffic in initiating from the internal subnet is get natted to the PAT/NAT IP.

For the VPN traffic you can create a NAT exception rule like below. For FTD go to FMC and create a rule like below

nat(inside,wan) source static inside-subnet inside-subnet destination static remote-subnet remote-subnet

HTH
Abheesh

Re: Nat exception for VPN on FTD

Sheraz.Salim — Mon, 03 Dec 2018 11:57:58 GMT

Hi orkhan,

the concept of FTD natting and ASA natting is same.

as long as you understand the concept of ASA nat you should be fine with FTD only change is FTD is GUI.

just create the object as

object network INSIDE

subnet 192.168.1.0 255.255.255.0

object network REMOTE-SIDE

subnet 172.16.1.0 255.255.255.0

nat(inside,outside) source static INSIDE INSIDE destination static REMTOE-SIDE REMOTE-SIDE no proxy arp

sorry the above sytax is for ASA but FTD must be a very similar in GUI.

thanks.

Re: Nat exception for VPN on FTD

Cristian Matei — Thu, 09 Apr 2020 07:55:04 GMT

Hi,

Your NAT configuration makes use of the "any" keyword for the destination interface object?

Regards,

Cristian Matei.