Source NAT through vpn tunnels

I decided to try your way.

1.Create route-based VPN Connection rule for B - C, then you get a VTI interface to C.

But you need using CLI to modify the local/remote policy from any to the address object B, C

crypto map VPNConnectionName

local-policy any → local-policy address-objectB

remote-policy any → remote-policy address-objectC

This works, vpn is up and vti too.

2.Create policy route rule for B to C, SNAT to fakeB.

Even this works: in routing traces I see three steps

-real B LAN → C host - from vpn id 0 to id 0 - incoming interface x - outgoing VTI0

-fake B LAN → C host - from vpn id 0 to id 0 - incoming interface x - outgoing VTI0

-C host → real B LAN - from vpn id 5 to id 0 - incoming interface x - outgoing LAN1

3.Create policy route rule for A to C, SNAT to fakeB.

And this doesn't work. I've checked also policy control but it doesn't generate events, it seems a routing issue.

On A firewall, I simply see

-A host → C host - from vpn id 0 to id 2 - incoming interface x - outgoing doll

But nothing comes back.

On B firewall, traffic is received from A site, sent to C, received from C and finally not sent to A.

Routing traces show

-A host → C host - from vpn id 3 to id 0 - incoming interface x - outgoing VTI0

-Fake B LAN → C host - from vpn id 3 to id 0 - incoming interface x - outgoing VTI0

-C host → real A host - from vpn id 5 to id 0 - incoming interface x - outgoing WAN1

Outgoing WAN1… why?

I look at rule and I don't find anything wrong

user: any - incoming: tunnel - A-B - source address: A host - destination address: C host - dscp: any - schedule: none - Service: selected (also tried "any", it doesn't change) - next hop: interface VTI0 - SNAT to fake B

Right.

In initial setup, traffic flowed from A to B but then cannot go to C with SNAT.

Zyman2008 suggestion made things better. Now it goes to C with SNAT, it comes back to B but then it runs away on B WAN1 interface instead of going towards tunnel A-B.

VPN policy A-B has only A and B LAN1 subnets as local-remote policy.

Just to see if it helped, I had set policy route on B, but it didn't work.

With source VTI0 - dest A-B tunnel, last step went to WAN1, with source B-C tunnel - dest A-B tunnel it went to doll (but nothing to site A).

At that point, my suspect was that A-B tunnel rejected all what was outside its local-remote policy. Even if it was a return of something that had come out from it, and even with a policy.

So I created another phase 2 on same phase 1 between A-B, let's call A2-B2 tunnel.

On A, local-policy = A client - remote policy: C Host.

On B, the opposite.

Then, traffic began to flow.

The last step of trace on B firewall, from

-C host → real A host - from vpn id 5 to id 0 - incoming interface x - outgoing WAN1

became

-C host → real A host - from vpn id 5 to id 6 - incoming interface x - outgoing doll

id 6 is the new tunnel, A2-B2

Traffic didn't use same tunnel, it went from A to B in A-B tunnel (id 3) and came finally back in A2-B2 tunnel (id6).

Then I changed policy route on A to use A2-B2 as next-hop, and on B to use A2-B2 as source. Just because I like more this way, that both directions use same tunnel :-)

In both cases (same or different tunnel for opposite directions), I didn't need any "return" rule on B.