FTD VPN Question

[benolyndav]

HI

Quick qery

We havea VPN across the Internet to a third party from our FTD,  If I dont add a Nat excemption rule for the 172.16.x.x netwotk  does the traffic get natted to the Outside Interface nativley.??
Thanks

[Rob Ingram · Accepted solution]

@benolyndav yes it's more than likely to unintentially be translated behind the outside interface. So you will need a NAT exemption rule to ensure it does not.

[MHM Cisco World]

If it S2S VPN then you need NAT for 500/4500 udp port' this NAT for tunnel heads

If it RA VPN the vpn pool the client use it hidden so you dont neee no-NAT for vpn pool' but also you need NAT only for tunnel head.

MHM

[Marvin Rhoads]

As others have noted, if you have a dynamic interface NAT then you most likely need to exempt the interesting VPN traffic from that rule.

Refer to the FTD order of operations below where you can see in the outbound traffic flow that NAT policy is applied prior to VPN encryption.

FTD OOO - courtesy of Nazmul Rajib