cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
267
Views
15
Helpful
8
Replies
MrBeginner
Enthusiast

How many VPN can create behind NAT device

Hi,

I would like to ask about vpn behind behind NAT device.

Let say HUB and Spokes VPN devices ( firewalls) are behind NAT routers.

All NAT router have static WAN ip.All WAN ip can reachable each others.

Let me know can we create multiple vpn tunnel from spokes firewalls to hubs firewall behind the NAT router ?

 

1 ACCEPTED SOLUTION

Accepted Solutions

@MrBeginner 

Yes, that should work, assuming NAT-T is enabled (it is enabled as default on newer IOS/ASA).

Hub can be behind static NAT. Spokes can be behind Dynamic PAT/NAT or static NAT.

 

If you meant the spokes where behind the same NAT device, obviously it would be same source IP address. With NAT-T the destination port of the Hub would be udp/4500, but the source port of each spoke firewall would be a random high port, this is how the hub firewall can differentiate between the spokes.

 

Afaik, the limitations would be the number of VPN peers the Hub can scale to.

 

If using ASA, you'll have to use a dynamic crypto map on the hub, static crypto maps on the spokes.

View solution in original post

8 REPLIES 8
Deepak Kumar
VIP Advocate

Hi,

If all devices are having Static IP then you can use One to One nat on the hub and port-forwarding on the Spoke. it will work fine. 

Regards,
Deepak Kumar,
Don't forget to vote and accept the solution if this comment will help you!

Hi @Deepak Kumar 

Do you mean can not do if we are using dynamic nat ?

balaji.bandi
VIP Expert

You can ceate based on the model of the device support. as long as the resource not exausted.

 

Make sure you have static IP at HQ for the remote to connect.

 

By the way, what is this device ? ASA  or Router ? or ?

 

 

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help

hi @balaji.bandi 

Firewall is ASA. I only want to confirm can we create multiple tunnel behind the NAT devices. I knew that if HUB device is public ip and spokes devices are behind the NAT device, we can create multiple tunnel.

I didn't see sample of lab or references design which all hub and spoke vpn devices are behind the NAT routers.

As per your answer, Multiple tunnel is no issue depend on the firewall resources ?

You mean HUB also behind NAT ? also Spoke also behind NAT ? then that is not workable solution i guess here.

 

HUB need to have always Public IP exposed.

 

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help

Hi,

Hub and spoke are behind the NAT .

As per below link ,Juniper support can support both initiator and responder are behind the nat device.

 

https://www.juniper.net/documentation/us/en/software/junos/vpn-ipsec/topics/topic-map/security-route-based-and-policy-based-vpns-with-nat-t.html

 

but i am not sure cisco and other devices can support or not.And then i am not sure how many nat can create or not.

 

 

I have not tried  Hub behind NAT - that is not tested by my self - but good use case, but there is limitations alwyas Hub behind NAT.

BB

***** Rate All Helpful Responses *****

How to Ask The Community for Help

@MrBeginner 

Yes, that should work, assuming NAT-T is enabled (it is enabled as default on newer IOS/ASA).

Hub can be behind static NAT. Spokes can be behind Dynamic PAT/NAT or static NAT.

 

If you meant the spokes where behind the same NAT device, obviously it would be same source IP address. With NAT-T the destination port of the Hub would be udp/4500, but the source port of each spoke firewall would be a random high port, this is how the hub firewall can differentiate between the spokes.

 

Afaik, the limitations would be the number of VPN peers the Hub can scale to.

 

If using ASA, you'll have to use a dynamic crypto map on the hub, static crypto maps on the spokes.

View solution in original post

Content for Community-Ad