In Nat Site1-to-site 2 you've configured Source and Destination nat with bidirectional . Then why we need Site2-to-site1 Natting ? I think Bidirectional Nat will work if traffic would be generated through site 2 . Please correct me if i am wrong
Doubt: Do we really need the 2nd access policy from outside to inside ( 100.1.2.1 to 100.1.1.1) ? In ASA, vpn traffic is exempted for acl filtering on outside interface with "sysopt vpn traffic" command. However let's say it needed, then why we put the NAT IP of inside zone as destination in the rule rather the original subnet(10.1.1.0/24), as we know, after the destination nat look up ,policy look up will be happened. So post dest nat look up it will be changed to 10.1.1.0 and policy will check for destination as 10.1.1.0 not 100.1.1.0/24
Can you please explain this comparing to the life of a packet flow in Palo alto ?? basically when return traffic-> 100.1.2 to 100.1.1- > first it will look for Destination NAT - As there is DNAT 100.1.1 to 10.1.1 but again it will check for the security policy in which there is no policy allowed from Outside to inside with source- 100.1.2 to 10.1.1 right ?? can you please answer to this doubt? am I missing anything?
Do you have a video on how to configure a windows pc on eve-ng? I tried with windows 11 virtual pc, but the hard drive size of the vm needs to be 80g and it would consume the hard drive space that I allocated for the eve-ng environment. I had to increase the size a couple times of the eve-ng hard disk to accommodate the virtual windows pc. What do you recommend is the best image to use in eve-ng which is the lighest and does not consume much disk space?
Hello Marrr, You can follow this video (th-cam.com/video/Nz4egjiPDqE/w-d-xo.html). For eve ng i have allocated 500GB SSD, actually images and lab take more space.
Hi Bikash, great videos.. Thank you for them.. please help me understand if we are doing the static NAT why we are the whole network instead of single IP?
At 24:07 your 2nd NAT rule is wrong. The destination zone is still the outside because it's not translated yet. What security zone did you put 100.1.1.0 and 100.1.2.0 in?
@@shivsankar455 I actually wasn't right. For a moment think of a classic port-forwarding NAT rule you've added. E.g. webserver 443/tcp translated to an internal address. Your destination zone would still be the outside zone (WAN). And the translated address would belong to an internal zone (DMZ). That's because those who are visiting your webserver do NOT know of the internal addresses. And they are visiting using the WAN address. But with this IPSEC example, there are static routes in place for the internal addresses, so the destination zone is just your internal zone (LAN) and not the outside zone. The bidirectional option isn't needed. You've already created two rules in both directions. The bidirectional option never worked properly for me if you filled in the destination address values. It's just better to create two separate rules without that option.
tq, before seing this video i don't know weather a way to overcome IPSEC Network overlapping. now i got complete knowledge of ipsec tq so much
Your videos are awesome my friend! I sent you some money the other day.
Awesome scenario Bikash... really this should have wonderful game playing with NAT. And great job Bikash, you deserve it . God bless you...
You are the best, this scenario helped me allot at professional level, thanks allot
Nice!! What about 2nd case where policy NAt option is unable in company B. So twice NAT need to configure
In Nat Site1-to-site 2 you've configured Source and Destination nat with bidirectional . Then why we need Site2-to-site1 Natting ? I think Bidirectional Nat will work if traffic would be generated through site 2 . Please correct me if i am wrong
I have the same above question in my mind..
@bikash..
Can you please clarify it.
Doubt:
Do we really need the 2nd access policy from outside to inside ( 100.1.2.1 to 100.1.1.1) ? In ASA, vpn traffic is exempted for acl filtering on outside interface with "sysopt vpn traffic" command.
However let's say it needed, then why we put the NAT IP of inside zone as destination in the rule rather the original subnet(10.1.1.0/24), as we know, after the destination nat look up ,policy look up will be happened. So post dest nat look up it will be changed to 10.1.1.0 and policy will check for destination as 10.1.1.0 not 100.1.1.0/24
Can you please explain this comparing to the life of a packet flow in Palo alto ?? basically when return traffic-> 100.1.2 to 100.1.1- > first it will look for Destination NAT - As there is DNAT 100.1.1 to 10.1.1 but again it will check for the security policy in which there is no policy allowed from Outside to inside with source- 100.1.2 to 10.1.1 right ?? can you please answer to this doubt? am I missing anything?
I have the same doubt.. when dnat is checked first so second rule should have real ip address
Very nicely explained the complex thing in simple way.
Thank you 😊
Do you have a video on how to configure a windows pc on eve-ng? I tried with windows 11 virtual pc, but the hard drive size of the vm needs to be 80g and it would consume the hard drive space that I allocated for the eve-ng environment. I had to increase the size a couple times of the eve-ng hard disk to accommodate the virtual windows pc. What do you recommend is the best image to use in eve-ng which is the lighest and does not consume much disk space?
Hello Marrr,
You can follow this video (th-cam.com/video/Nz4egjiPDqE/w-d-xo.html). For eve ng i have allocated 500GB SSD, actually images and lab take more space.
Hi Bikash, great videos.. Thank you for them.. please help me understand if we are doing the static NAT why we are the whole network instead of single IP?
At 24:07 your 2nd NAT rule is wrong. The destination zone is still the outside because it's not translated yet. What security zone did you put 100.1.1.0 and 100.1.2.0 in?
Also if we enabling bidirectional nat in first rule why we need another NAT?
Also, we are consuming entire /24 block of public ip.
You are right
@@shivsankar455 I actually wasn't right. For a moment think of a classic port-forwarding NAT rule you've added. E.g. webserver 443/tcp translated to an internal address.
Your destination zone would still be the outside zone (WAN). And the translated address would belong to an internal zone (DMZ). That's because those who are visiting your webserver do NOT know of the internal addresses. And they are visiting using the WAN address.
But with this IPSEC example, there are static routes in place for the internal addresses, so the destination zone is just your internal zone (LAN) and not the outside zone.
The bidirectional option isn't needed. You've already created two rules in both directions. The bidirectional option never worked properly for me if you filled in the destination address values. It's just better to create two separate rules without that option.
Very good explanation..!!
Thanks bro
hello sir many video are missing please add missing video of palo alto
Hi From where you get 100 subnet ?? That part having confusion.
thanks plz do some more such lab
great...
👍👌
Great work done by you bro, can u upload one vedio for site 2 site vpn failover in paloalto.......
So many wrong IPs explained on the screen starting at 7:00. Please pre-check your content before start recording
Yes same observation regarding sip and dip