SofaWare Home Page    sofaware.infopop.cc    SofaWare Discussion Groups  Hop To Forum Categories  SmartCenter Management    VPN Edge X, NAT in Enterprise VPN ?

Moderators: Asaf Levi

Closed Topic Closed
Go
New
Find
Notify
Tools
-star Rating Rate It!  Login/Join 
Junior Member
Posted
[Repost from "Internet Security Appliances" form I first posted it erroneusly, sorry].

Should the Edge X device be able to NAT nodes from LAN for connections going through an enterprise vpn ?

Edge X, fw 6.0.74, connected to a NGAIR55 smartcenter with libsw 6.0.81.
Lan network is 10/8 (customer, don't ask), DMZ port is 172.19.29/24. Local vpn endpoint are a couple of NGAIR55 nokia modules running vrrp. Local network is 172.18.1/24.
In smartcenter following is defined:
- the local nokia cluster object, encryption domain manual, contains 172.18/16 and other networks (no 10 network)
- the edge object, encryption domain manual, contains 172.19.29/24
- a nat rule 10/8->172.18.1/24 port any, translate to 172.19.29.200(hide)->original port original, install on "the Edge configuration container"
- relevant security rules permitting traffic, install on "the nokia cluster object"

When trying to connect from a node on the physical dmz port network (real IP 172.19.29.x) tunnel comes up normally, all ok.

When trying to connect from a LAN 10/8 node to a 172.18.1 node (source should be hide-natted to 172.19.29.200) tracker has these logs:
- Ike Main mode completition
- Ike quick mode completition for 172.28/16 and <edge public ip address>
- Ike quick mode completition for <edge public ip address> and 10/8 (which is not mentioned in any encryption domain)
- Ike quick mode completition for 172.18/16 and 10/8
- drop <10 node ip>-><172.18 ip> "encryption failure: Cannot identify peer for encrypted connection (VPN Error code 04)"
but no quick mode for 172.19/29 and 172.18/16 (and the connection fails).

"info nat" on Edge does not show any entry.
I also tried to nat the lan nodes on a network different than the dmz port, (with correct encryption domains), doesn't work either.
I also tried nat 10/8->any (always nat) and so on, never seemd to be used, as if nat is ignored if the traffic goes into a tunnel.

Is there any solution to this, am I doing something wrong ? Performing nat on the central endpoint would create loads of conflict due to that 10/8 network.
Is this kind of configuration even supported on the edge X series ? Possibly with v7 firmware ?

Thanks
 
Posts: 4 | Registered: June 14, 2005Edit or Delete MessageReport This Post
  Powered by Eve Community  

Closed Topic Closed

SofaWare Home Page    sofaware.infopop.cc    SofaWare Discussion Groups  Hop To Forum Categories  SmartCenter Management    VPN Edge X, NAT in Enterprise VPN ?

© Copyright 2006 SofaWare Technologies Ltd.
How To Buy