Traffic between tunnels (and NAT)

valerio_vanni

Let's say we have three sites: A, B, C.

Between A and B: policy-based site-to-site tunnel

Between B and C: policy-based site-to-site tunnel

Then we need that an host (a single host) from site A reaches an host or a couple of site C. Only

So the config would be

On A:

-policy route with source host, destination host, next hop=A-B-tunnel

(do I need a "return" rule or is it implicit since destination of return traffic is in Site A LAN and so included in default vpn policy route?)

On B:

-policy route with source host (A), destination host (C), next hop=B-C-tunnel

-policy route with source host (C), destination host (A), next hop=A-B-tunnel

On C: like A but inverted.

Is it ok?

And another question: let's say that I want to NAT A host, when it goes to C site, with an address of B LAN. As it would come from that network: this would make simpler things on C site, that should simply relate with B one.

In which routing policy should I set "SNAT-to"? In the first step (policy route from A to B)?

PeterUK

looks correct do a test here HQ1, HQ2 and HQ3

VLAN66 192.168.66.3 > HQ1 > Tunnel >HQ2 > route to tunnel > HQ3 VLAN47 192.168.255.40

HQ1 route incoming VLAN66 destination 192.168.255.32/28 next hop to tunnel

HQ2 route incoming tunnel destination 192.168.255.32/28 to next hop to tunnel

HQ2 route incoming tunnel destination 192.168.66.0/24 to next hop to tunnel

HQ3 route incoming VLAN47 destination 192.168.66.0/24 next hop to tunnel