VPN Site To Site , Firewall

Toggle sidebar Toggle sidebar
A

Alessio21

Reputable
Feb 7, 2016
2
0
4,510
Hi, i am new to Networking and Security in general,
i have a problem setting up a VPN Ipsec Site-to-Site with a Customer,
Below is a brief description of my network:
network A (vlan 1 / management) 192.168.1.0/24
network B (vlan 100 / computers) 192.168.10.0/24
The network that I have to connect via VPN connection, is the network B, unfortunately, the customer with which I have to establish a vpn connection, has my same network 192.168.1.0/24 (network C)
There must be a two-way NAT (carried on both firewall, or just a NAT from my network to the remote?
I have very confused ideas about, all the guides I find, explain how to communicate two identical networks, but that's not my case because the customer has not itself a network b, so he can prepare a routing as follows: c network (local)> b network (remote) with no address conflict

My firewall is Zyxel USG 1100
Thanks in advice
 
Solution
B
There are a couple ways to do this some very fancy but the brute force method tends to be the simplest to maintain. Just source nat all your 192.168.1.x address to 192.168.2.x 1-1. Then destination nat all his 192.168.1.x addresses to 192.168.3.x again 1-1. The firewall will automatically reverse the roles for traffic coming the other way so you should not have to put in a reverse source/destination nat. This of course is only for traffic going outside your network you both would continue to use 192.168.1.x locally. If you have DNS involved it will get even more messy.

So you will always address his machines as 192.168.3.x and he will always use 192.168.2.x to access yours.

I am not sure if your firewall can do this but...
Sort by date Sort by votes
B

bill001g

Titan
Aug 9, 2012
28,363
2,766
125,640
There are a couple ways to do this some very fancy but the brute force method tends to be the simplest to maintain. Just source nat all your 192.168.1.x address to 192.168.2.x 1-1. Then destination nat all his 192.168.1.x addresses to 192.168.3.x again 1-1. The firewall will automatically reverse the roles for traffic coming the other way so you should not have to put in a reverse source/destination nat. This of course is only for traffic going outside your network you both would continue to use 192.168.1.x locally. If you have DNS involved it will get even more messy.

So you will always address his machines as 192.168.3.x and he will always use 192.168.2.x to access yours.

I am not sure if your firewall can do this but most actually firewall can.....consumer routers with firewall features generally can not.

 
Upvote 0 Downvote
Solution
A

Alessio21

Reputable
Feb 7, 2016
2
0
4,510
My management network dont have to comunicate with remote lan;
network A have to comunicate with network B while network B have to comunicate with network A and network C, so is it necessary to nat traffic even on the remote side (customer firewall)?
Thanks
 
Upvote 0 Downvote
B

bill001g

Titan
Aug 9, 2012
28,363
2,766
125,640
The nat will only be done on your firewall. if your net a is not involved then you can just do a simple destination 1-1 nat and translate the remote 192.169.1.x address to 192.168.3.x. Your communication would then appear to be happening between 192.168.10.x and 192.168.3.x.
 
Upvote 0 Downvote
You must log in or register to reply here.

TRENDING THREADS

Latest posts

Moderators online

Share this page

COMPANY
RESOURCES
FOLLOW
Top Bottom