CloudLabBox
Try the free demo

Firewalls and VPNs lab 8 of 16

NAT and VPN together - exemptions identities and NAT-T

Connect an ASA site and a FortiGate site to an IOS head office. Exempt VPN traffic from the ASA's PAT with identity NAT, keep NAT out of the FortiGate's VPN policies, and bring up a tunnel to a FortiGate that sits behind its ISP's static NAT, where NAT traversal and a private IKE identity both have to be handled.

Run this lab

It needs Lite: its 6 nodes are set to 6 vCPU and 6,144 MB in total. That fits the free demo too.

In your workspace: Shared, then Firewalls and VPNs multi-vendor guided labs, then 08 - NAT and VPN together - exemptions identities and NAT-T

Try it free for 30 minutesRun it on Lite from £3 a day

The free demo needs no card and no email. Every lab plan includes every guided lab.

Level
Intermediate
Time
About 90 minutes
Nodes need
6 vCPU, 6,144 MB
Smallest plan
Lite

The scenario

Quarry Lane Builders' Merchants runs its head office on a Cisco router. It has just bought a yard (site A) that came with a Cisco ASA, and it is opening a depot (site B) with a FortiGate on a business line. That line's ISP hands the FortiGate a shared-space address, 100.64.0.2, and maps it one to one to the public address 192.0.2.77. Both sites already reach the internet through NAT. Join both to HQ without breaking that.

DeviceInterfaceAddressNotes
ISPGi0/0 / Gi0/1 / Gi0/2 / Lo0203.0.113.1/30 / 198.51.100.1/30 / 100.64.0.1/30 / 192.0.2.80Static NAT 100.64.0.2 = 192.0.2.77; Lo0 is a web server
HQGi0/0 / Lo0203.0.113.2/30 / 10.0.0.1/24Lo0 stands in for the server LAN
A-FWinside / outside10.1.0.1/24 / 198.51.100.2/30PAT for 10.1.0.0/24
A-PCGi0/010.1.0.10/24
B-FWport1 / port2 / to-HQ100.64.0.2/30 / 10.2.0.1/24 / 169.254.82.2Policy 1 is LAN-to-Internet with NAT
B-PCGi0/010.2.0.10/24
HQ Tunnel2VTI to B-FW169.254.82.1/30
TunnelDesignCryptoKeyIdentities
A-FW to HQCrypto map on both, 10.1.0.0/24 to 10.0.0.0/24IKEv2 AES-256-GCM, PRF SHA-384, DH 20; ESP AES-256-GCM, PFS 20Quarry-ASA-27IP addresses
B-FW to HQRoute-based on both (0.0.0.0/0 selectors)IKEv2 DES/SHA-256, DH 14; ESP DES/SHA-256, PFS 14Quarry-FGT-27B-FW sends FQDN branch.example

The FortiGate uses DES only because its evaluation licence offers nothing stronger; with a licence you would use AES-256-GCM and DH 19, 20 or 21, like the ASA tunnel.

What you’ll practise

  • Explain where NAT happens relative to encryption on the ASA, IOS and FortiGate
  • Exempt site-to-site traffic from PAT on the ASA with a section 1 identity NAT rule
  • Keep FortiGate VPN policies separate from the internet policy, without NAT
  • Recognise NAT traversal when a peer's address is translated 1:1 and no ports change
  • Identify a peer behind NAT by FQDN instead of by its private address
  • Verify NAT and VPN together with show nat detail, show crypto ikev2 sa detail and diagnose vpn ike gateway list

The tasks

  1. Where does NAT happen?
  2. A-FW to HQ
  3. B-FW to HQ, through the ISP's NAT
  4. Prove it

The Lab Tasks pane has the scenario, these tasks, the checks to run, hints and the full solution.

Topology and devices

The network as it opens in EVE-NG, drawn from the lab’s own canvas, and the image each node runs.

Topology of NAT and VPN together - exemptions identities and NAT-T6 nodes, 5 links. Every link is listed as text below the diagram.ISPHQA-FWA-PCB-FWB-PCGi0/0Gi0/0Gi0/0Gi0/0port2Gi0/0Gi0/1Gi0/1Gi0/2port1
6 nodes, with the interface names each link uses. On a narrow screen, scroll the diagram sideways.
Every link, as text
  • ISP Gi0/0 to HQ Gi0/0
  • ISP Gi0/1 to A-FW Gi0/1
  • ISP Gi0/2 to B-FW port1
  • A-FW Gi0/0 to A-PC Gi0/0
  • B-FW port2 to B-PC Gi0/0
Nodes in NAT and VPN together - exemptions identities and NAT-T, with the image each runs and the vCPU and RAM it’s set to
NodeDeviceImage in Add NodeSet to
ISPCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
HQCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
A-FWCisco ASAvasav-9.22.1.1-PLR-Licensed1 vCPU, 2,048 MB
A-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB
B-FWFortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB
B-PCCisco IOSvvios-adventerprisek9-m.spa.159-3.m91 vCPU, 512 MB

How to open this lab

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder Firewalls and VPNs multi-vendor guided labs.

  3. Open 08 - NAT and VPN together - exemptions identities and NAT-T and start its nodes, then open Lab Tasks for the scenario and the steps.

The lab is read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change it, rebuild it in your own folder.

More Firewalls and VPNs labs

All Firewalls and VPNs labs

Related labs in other courses

CloudLabBox is independent of Check Point, Cisco, CompTIA, Fortinet, Juniper Networks, MikroTik, Netgate and Palo Alto Networks. The lab follows exam topics and isn’t vendor training material; vendor names identify the exams and the images in the workspace.