VPN IPSEC with a nat-enabled router
Hi. I've a litte question about a VPN problem.
The situation is this:
Internet =70.4.... (with 1 public static IP) => Fiber routrer == 192.168.1.x ==> USG110 ==192.168.10.x= => LAN
The customer has another person that needs to connect to the lan. I tried with SSL VPN and it worked fine (I natted all ports from router to firewall), but my boss sold them the IPSEC license. I tried the autoconfiguration but, when I download the cofiguration from the client, it sets the destination IP the wan IP of the firewall (192.168.1.2) and not the external one. So the client won't work. If I manually the remote gateway on the client with the public IP, everything stops after "sending phase 1 ID".
Unfortunatly I cannot put the pubblic IP on firewall's wan
I read some docs, but I cannot find my actual situation to search any hint for the config
0
All Replies
-
Hi @Cava
In your scenario, the VPN must be established via the public ip address, so the following configuration must be done on the fiber router:
- Static NAT:
Source: Public IP address on the fiber router
Destination: 192.168.1X (WAN USG110)
Port: 500 UDP, 4500 UDP
And the IP protocols: ESP (Ip protocol 50) and AH (ip protocol 51).
Best regards
0 -
Thanks. There was a rule for a video conference sw that was natting the 4500 on another network.
0
Categories
- 8.1K All Categories
- 1.6K Nebula
- 60 Nebula Ideas
- 54 Nebula Status and Incidents
- 4.4K Security
- 224 Security Ideas
- 963 Switch
- 45 Switch Ideas
- 868 WirelessLAN
- 20 WLAN Ideas
- 5.2K Consumer Product
- 139 Service & License
- 268 News and Release
- 53 Security Advisories
- 12 Education Center
- 573 FAQ
- 273 Nebula FAQ
- 132 Security FAQ
- 73 Switch FAQ
- 72 WirelessLAN FAQ
- 7 Consumer Product FAQ
- Documents
- 34 Nebula Monthly Express
- 71 About Community
- 44 Security Highlight