IPSec tunnel with NAT

No.9527 · Created Dec 14, 2018 07:54:17

please help confirm whether the LAN network is on AR side?
If so,
1. you should deny the ipsec tunnel segment in you acl rule which is for NAT, then apply it on the output interface
2. configure the common ipsec acl rule for your ipsec tunnel

for example:
acl number 3001
rule 5 deny ip source 172.60.60.0 0.0.0.255 destination 196.197.191.23 0
rule 10 deny ip source 172.60.60.0 0.0.0.255 destination 196.197.191.20 0
rule 15 permit ip
#
interface Cellular0/0/0
nat outbound 3001

andsta · Created Dec 13, 2018 11:02:34

Hello,

If I understand correctly you would like to creat an IPsec tunnel though NAT.
Please refer to the following link in the product documentation as a configuration example:
http://support.huawei.com/hedex/hdx.do?docid=EDOC1000163385&id=dc_cfg_ipsec_0063&text=Example%252520for%252520Establishing%252520an%252520IPSec%252520Tunnel%252520Through%252520NAT%252520Traversal&lang=en

Hope this helps.

No.9527 · Created Dec 14, 2018 07:54:17

please help confirm whether the LAN network is on AR side?
If so,
1. you should deny the ipsec tunnel segment in you acl rule which is for NAT, then apply it on the output interface
2. configure the common ipsec acl rule for your ipsec tunnel

for example:
acl number 3001
rule 5 deny ip source 172.60.60.0 0.0.0.255 destination 196.197.191.23 0
rule 10 deny ip source 172.60.60.0 0.0.0.255 destination 196.197.191.20 0
rule 15 permit ip
#
interface Cellular0/0/0
nat outbound 3001

lpribeiro · Created Dec 14, 2018 18:58:18

Hello,

No, the purpose is not to create an IPSec tunnel with a NAT device on front. I need to NAT the LAN network before sending the traffic to the remote site, because the remote site has the same network.

In the example you have sent, it would be like having the network 10.1.0.0/24 on both sites.

Many thanks.

Hawasli · Created Dec 15, 2018 20:58:01

Need more information

alfreds · Created Feb 26, 2019 06:45:27

Good Morning everyone,

I have the opposite scenario where I have established an IPSec tunnel from a AR1220 to a USG6330 firewall, but, I don't need to NAT the LAN traffic before, because the remote LAN IP addresses does not overlap,

Any solutions on this for me

atif412 · Created Jul 22, 2019 06:38:07

I have same issue, please help me to resolve this

justinfox · Created Jun 7, 2020 23:32:04

thanks!!

LilStylz237 · Created Jun 8, 2020 06:14:46

great

IPSec tunnel with NAT

Recommended answer

Third Party’s Trade Secret

My Followers

Enterprise

Consumer

Corporate

Carriers

IPSec tunnel with NAT

Recommended answer

Third Party’s Trade Secret

My Followers