Configure Outgoing Dynamic NAT Through a Branch Office VPN Tunnel

You can use dynamic NAT (DNAT) through Branch Office VPN (BOVPN) tunnels. Dynamic NAT acts as unidirectional NAT, and keeps the VPN tunnel open in one direction only. This can be helpful when you make a BOVPN tunnel to a remote site where all VPN traffic comes from one public IP address.

For example, suppose you want to create a BOVPN tunnel to a business partner so you can get access to their database server, but you do not want this company to get access to any of your resources. Your business partner wants to allow you access, but only from a single IP address so they can monitor the connection.

You must know the external and trusted network IP addresses of each VPN endpoint to complete this procedure. If you enable dynamic NAT though a BOVPN tunnel, you cannot use the VPN failover feature for that VPN tunnel.

The step-by-step instructions below work with any BOVPN that uses dynamic NAT to make all traffic from one endpoint appear to come from a single IP address. The DNAT address can be any routable IP address, such as the Site A public IP address, or a private IP address on the trusted network at Site A. The images show the settings for a BOVPN where all traffic from Site A must come from the public IP address of Site A.

Site A

Public IP address — 203.0.113.2

Trusted Network — 10.0.1.0/24

Site B

Public IP address — 198.51.100.2

Trusted Network — 10.50.1.0/24

In Fireware v12.4 or higher, if you select IPv6 Addresses as the Address Family, you cannot configure NAT. NAT is not supported for IPv6 BOVPN gateways.

Configure the Endpoint Where All Traffic Must Appear to Come from a Single Address (Site A)

For the device at Site A, configure the BOVPN gateway. For more information, go to Configure Manual BOVPN Gateways. Then use the steps below to configure dynamic NAT in the tunnel route settings.

Configure the Endpoint that Expects All Traffic to Come from a Single IP Address (Site B)

For the device at Site B, configure the BOVPN gateway. For more information, go to Configure Manual BOVPN Gateways. Then use the steps below to configure dynamic NAT in the tunnel route settings.

When the device at Site B restarts, the two devices negotiate a VPN tunnel. The Site A device applies dynamic NAT to all traffic sent to the trusted network of the Site B device. When this traffic reaches Site B, it arrives as traffic that originated from the DNAT IP address.

Related Topics

About Dynamic NAT

Configure 1-to-1 NAT Through a Branch Office VPN Tunnel