topic FTD VPN Question in Network Security

FTD VPN Question

benolyndav — Wed, 17 Jan 2024 08:12:58 GMT

Quick qery

We havea VPN across the Internet to a third party from our FTD, If I dont add a Nat excemption rule for the 172.16.x.x netwotk does the traffic get natted to the Outside Interface nativley.??
Thanks

Re: FTD VPN Question

Rob Ingram — Wed, 17 Jan 2024 08:17:54 GMT

@benolyndav yes it's more than likely to unintentially be translated behind the outside interface. So you will need a NAT exemption rule to ensure it does not.

Re: FTD VPN Question

MHM Cisco World — Wed, 17 Jan 2024 08:26:02 GMT

If it S2S VPN then you need NAT for 500/4500 udp port' this NAT for tunnel heads

If it RA VPN the vpn pool the client use it hidden so you dont neee no-NAT for vpn pool' but also you need NAT only for tunnel head.

MHM

Re: FTD VPN Question

Marvin Rhoads — Wed, 17 Jan 2024 13:44:18 GMT

As others have noted, if you have a dynamic interface NAT then you most likely need to exempt the interesting VPN traffic from that rule.

Refer to the FTD order of operations below where you can see in the outbound traffic flow that NAT policy is applied prior to VPN encryption.

FTD OOO - courtesy of Nazmul Rajib