Description:
In some cases, two sites may be using the same IP address range. To enable VPN communications between these sites, communication via the VPN tunnel must be masked behind a different IP address range. This is implemented on a Unified Firewall with the help of NETMAP. In contrast to source NAT, both sides can access resources in the other target network.
This article describes how to set up NETMAP masquerading for a VPN connection between two Unified Firewalls.
Note that communication with one of the masked networks via the VPN connection can only address the masked IP address. |
Requirements:
Scenario 1: Two locations with the same IP address range are to communicate via an IKEv2 connection
Scenario 2: Two external sites with the same IP address range are to communicate via an IKEv2 connection
Procedure:
Scenario 1: Two locations with the same IP address range are to communicate via an IKEv2 connection
1) Configuration steps at the headquarters:
1.1) Setting up the IKEv2 connection on the Unified Firewall at the Headquarters:
1.1.1) Set up the IKEv2 connection at the Headquarters using one of the following Knowledge Base articles:
1.1.2) When configuring the VPN connection, go to the Tunnels tab and adjust the Local Networks and Remote Networks as follows:
The IP address ranges used for masking must not be used elsewhere and must not overlap. |
1.1.3) Switch to the Routing tab, activate the Route-based IPsec and click Save.
1.1.4) Change to the menu Network → Routing → Routing Tables and, in Table 254, click on the “pencil” icon to edit the routing table.
1.1.5) Click on the “+” icon to create a routing entry.
1.1.6) Modify the following parameters and click OK:
1.1.7) Click Save to accept the routing entry.
1.2) Setting up the masking on the Unified Firewall at the Headquarters:
1.2.1) On the desktop, click the network object at the Headquarters (in this example Production-Headquarter), select the connection tool and click the VPN object (in this example VPN-Office).
NETMAP works exclusively with a VPN network but not with a VPN host. |
1.2.2) Switch to the NAT tab, adjust the following parameters and click Save:
With N:N mapping, the masking is done in two parts. The outbound data traffic is masked using source NAT and the inbound data traffic is masked using destination NAT. |
1.2.3) Finally, implement the changes by clicking Activate.
1.2.4) This concludes the configuration steps on the Unified Firewall at the Headquarters.
2) Configuration steps at the branch office:
2.1) Setting up the IKEv2 connection on the Unified Firewall at the Branch office:
2.1.1) Set up the IKEv2 connection at the Branch office using one of the following Knowledge Base articles:
2.1.2) When configuring the VPN connection, go to the Tunnels tab and adjust the Local Networks and Remote Networks as follows:
The IP address ranges used for masking must not be used elsewhere and must not overlap. |
2.1.3) Switch to the Routing tab, activate the Route-based IPsec and click Save.
2.1.4) Change to the menu Network → Routing → Routing Tables and, in Table 254, click on the “pencil” icon to edit the routing table.
2.1.5) Click on the “+” icon to create a routing entry.
2.1.6) Modify the following parameters and click OK:
2.1.7) Click Save to accept the routing entry.
2.2) Setting up the masking on the Unified Firewall at the branch office:
2.2.1) On the desktop, click the network object used at the branch office (in this example Production-Office), select the connection tool and click the VPN object (in this example VPN-Headquarter).
NETMAP works exclusively with a VPN network but not with a VPN host. |
2.2.2) Switch to the NAT tab, adjust the following parameters and click Save:
With N:N mapping, the masking is done in two parts. The outbound data traffic is masked using source NAT and the inbound data traffic is masked using destination NAT. |
2.2.3) Finally, implement the changes by clicking Activate.
2.2.4) This concludes the configuration steps on the Unified Firewall at the branch office.
3) Restart the VPN connection:
The VPN connection must be restarted for the adjusted VPN-connection parameters to come into effect. |
Connect to the Unified Firewall at the branch office or headquarters, switch to the menu VPN → IPsec → Connections, and click on the “circular arrow” icon for the corresponding VPN connection.
Scenario 2: Two external sites with the same IP address range are to communicate via an IKEv2 connection
1) Configuration steps at the headquarters:
1.1) Setting up the IKEv2 connection to branch office 2:
1.1.1) On the Unified Firewall at the Headquarters, set up the IKEv2 connection to Branch office 2 using one of the following Knowledge Base articles:
1.1.2) When configuring the VPN connection, go to the Tunnels tab and adjust the Local Networks and Remote Networks as follows:
1.2) Modifying the VPN connection to branch office 1:
1.2.1) Switch to the menu VPN → IPsec → Connections and, for the VPN connection to branch office 1, click the “pencil” icon to modify the connection.
1.2.2) Switch to the Tunnels tab, adjust the following parameters and click Save:
2) Configuration steps at branch office 1:
2.1) Modifying the VPN networks in Branch office 1:
2.1.1) Connect to the web interface of the Unified Firewall at branch office 1, go to the menu VPN → IPsec → Connections and, for the VPN connection to the headquarters, click on the “pencil” icon to edit it.
2.1.1) Change to the Tunnels tab and modify the following parameters:
The IP address ranges used for masking must not be used elsewhere and must not overlap. |
2.1.3) Switch to the Routing tab, activate the Route-based IPsec and click Save.
2.1.4) Change to the menu Network → Routing → Routing Tables and, in Table 254, click on the “pencil” icon to edit the routing table.
2.1. 5) Click on the “+” icon to create a routing entry.
2.1.6) Modify the following parameters and click OK:
2.1.7) Create a new routing entry, adjust the following parameters and click OK:
2.1.8) Click Save to accept the routing entry.
2.2) Setting up the masking on the Unified Firewall at branch office 1:
2.2.1) On the desktop of the Unified Firewall, click the network object at branch office 1 (in this example INTRANET-Office1), select the connection tool and click the VPN object (in this example VPN-Headquarter).
NETMAP works exclusively with a VPN network but not with a VPN host. |
2.2.2) Switch to the NAT tab, adjust the following parameters and click Save:
With N:N mapping, the masking is done in two parts. The outbound data traffic is masked using source NAT and the inbound data traffic is masked using destination NAT. |
2.2.3) Finally, implement the changes by clicking Activate.
2.2.4) This concludes the configuration steps on the Unified Firewall at branch office 1.
3) Configuration steps at branch office 2:
3.1) Setting up the IKEv2 connection on the Unified Firewall at branch office 2:
3.1.1) Set up the IKEv2 connection on the Unified Firewall at Branch office 2 using one of the following Knowledge Base articles:
3.1.2) When configuring the VPN connection, go to the Tunnels tab and adjust the Local Networks and Remote Networks as follows:
The IP address ranges used for masking must not be used elsewhere and must not overlap. |
3.1.3) Switch to the Routing tab, activate the Route-based IPsec and click Save.
3.1.4) Change to the menu Network → Routing → Routing Tables and, in Table 254, click on the “pencil” icon to edit the routing table.
3.1.5) Click on the “+” icon to create a routing entry.
3.1.6) Modify the following parameters and click OK:
3.1.7) Create a new routing entry, adjust the following parameters and click OK:
3.1.8) Click Save to accept the routing entry.
3.2) Setting up the masking on the Unified Firewall at branch office 2:
3.2.1) On the desktop of the Unified Firewall, click the network object used at branch office 2 (in this example INTRANET-Office2), select the connection tool and click the VPN object (in this example VPN-Headquarter).
NETMAP works exclusively with a VPN network but not with a VPN host. |
3.2.2) Switch to the NAT tab, adjust the following parameters and click Save:
With N:N mapping, the masking is done in two parts. The outbound data traffic is masked using source NAT and the inbound data traffic is masked using destination NAT. |
3.2.3) Finally, implement the changes by clicking Activate.
3.2.4) This concludes the configuration steps on the Unified Firewall at branch office 2.
4) Restart the VPN connection:
The VPN connections must be restarted for the adjusted parameters to take effect. |
Connect to the Unified Firewall at one of the branch offices or headquarters, switch to the menu VPN → IPsec → Connections, and click on the “circular arrow” icon for the corresponding VPN connection. Do this for both VPN connections (Headquarters – Branch office 1 and Headquarters – Branch office 2).