Site to Site VPN over Internet

[benolyndav]

Hi

We have a site to site VPN from one of our Firewalls to a 3rd party in azure, should the traffic be natted or is it ok to have nat exemption in place for the servers traversing the VPN.??

Thanks

[Rob Ingram]

Hi@benolyndav I'd configure NAT exemption for traffic over the VPN, but it depends on what you defined as interesting traffic. As in if the peer VPN is expecting traffic from the real IP or the NAT ip address.

[benolyndav]

Hi Rob

Great thats what I was planning, whats the reasons we do it this way please.??
Thanks

[Rob Ingram · Accepted solution]

@benolyndav if you use a NAT exemption rule, you use the real IP address - that way the peer network can communicate bidirectional with the real IP address. It depends on what services were being used, for example if DNS lookups are required this would resolve the real IP address and communication could be established. If you were nattting over the VPN and a DNS lookup is performed it would resolve the real IP address, but traffic is natted to a different IP address and subsequent DNS resolution would fail.

If you wish to hide your real network, then you may wish to NAT. I generally NAT over a VPN as an exception, depending on who the VPN is with.

[MHM Cisco World]

The policy based vpn need routing to destiantion to forward traffic'

In your case there is no routing for real IP but there is routing for mapped IP

That why you need to NAT real to mapped to forward traffic via tunnel.