Confused About IPSec Tunnel Interface Routing with NAT
Hi everyone:
I've been struggling to get an IPSec configuration going using a tunnel interface configuration. Currently, I have no issues with the VPN connectivity itself. The IKEv2 negotiations complete successfully. However, I seem to be stuck on the routing, NAT, and/or access policies.
I have provided an Excalidraw drawing with all of the network details (anonymized).
The impetus for this setup is that our partner is requiring us to use a specific NAT IP for our local device. We are using a SonicWall TZ670 running SonicOS 7.
I have a packet capture running on the VPN tunnel interface. The issue I'm seeing is that while all traffic originating from our partner's remote device makes it to our SonicWall, the status column indicates "Received" on all of the logged packets. My understanding is that this is an indication that the route policy is not matching against this traffic.
For traffic in the opposite direction, the status is "Consumed" and shows all of the relevant access, NAT, and routing policies in the Policy group of columns.
The behavior our partner described is that their test pings to our local device is not getting replies. For packet captures on X0 (our default LAN interface), I do see that the ICMP echo packets are forwarded to our local device, but no replies in the opposite direction.
I'm least confident in my route configuration, since the source traffic I'm matching on is coming from our tunnel interface, but I also have the next hop set to that same tunnel interface (wasn't sure what else would make sense here). I do see that the live counter on the route policy is at 50K, though. (All of my other counters are nonzero as well, though the access policy count is tiny in comparison to the others.)
More generally, I'm struggling to understand how static routes/access polices and NAT work together. For example, if I want to allow a remote device on the other side of an IPSec tunnel to access my local device using a NAT policy, do I consider the destination my device's NAT IP (and thus, VPN zone) or do I consider my device's real IP (LAN zone).
Appreciate your time!