I have to implement a site-to-site tunnel over an existing WAN link. One of the routers currently NATs addresses from one LAN to the other (see diagram).
Firewall 2 does not yet exist - I plan on deploying it to accomplish the tunnel from Firewall 1 - to - Firewall 2.
Can I deploy Firewall 2, creating a VPN tunnel from Firewall 1 to Firewall 2, leaving the NAT functions (static, one-to-one) on Router 1, or would I need to perhaps have Firewall 2 do the NAT.
I am not sure if NAT can take place within a tunnel, and I suspect that it cannot.
Thank you in advance.
Accepted Solutions
YECA911ORG wrote:
I have to implement a site-to-site tunnel over an existing WAN link. One of the routers currently NATs addresses from one LAN to the other (see diagram).
Firewall 2 does not yet exist - I plan on deploying it to accomplish the tunnel from Firewall 1 - to - Firewall 2.
Can I deploy Firewall 2, creating a VPN tunnel from Firewall 1 to Firewall 2, leaving the NAT functions (static, one-to-one) on Router 1, or would I need to perhaps have Firewall 2 do the NAT.
I am not sure if NAT can take place within a tunnel, and I suspect that it cannot.
Thank you in advance.
Mike
If you are Natting the LAN addresses then yes you will need to do it on the firewalls because the IP header will not be available to the routers ie. the IP header available to the routers will have the source and dest IPs of the firewalls and not the LAN machines.
Jon
YECA911ORG wrote:
I have to implement a site-to-site tunnel over an existing WAN link. One of the routers currently NATs addresses from one LAN to the other (see diagram).
Firewall 2 does not yet exist - I plan on deploying it to accomplish the tunnel from Firewall 1 - to - Firewall 2.
Can I deploy Firewall 2, creating a VPN tunnel from Firewall 1 to Firewall 2, leaving the NAT functions (static, one-to-one) on Router 1, or would I need to perhaps have Firewall 2 do the NAT.
I am not sure if NAT can take place within a tunnel, and I suspect that it cannot.
Thank you in advance.
Mike
If you are Natting the LAN addresses then yes you will need to do it on the firewalls because the IP header will not be available to the routers ie. the IP header available to the routers will have the source and dest IPs of the firewalls and not the LAN machines.
Jon
