Question on NAT's across VPN tunnel
We have created an IPSEC tunnel that is going to a vendor of a cloud application we are going to be using. They need a mask of our internal IP's across the tunnel for communication back and forth.
Our outgoing policy is from the local VLAN source to the remote tunnel subnet range 172.x.x.x /22. This policy also contains a one to one IP Pool that encompasses the addresses they need our devices across the tunnel to have: 10.139.x.x /24. (Our local devices are 10.44.x.x)
I have also added individual Virtual IP's for the devices that need back and forth communication on the tunnel from 10.139.x.x (their end) to 10.44.x.x (our end). The mapped from addresses are numbers within the one to one IP Pool in the outgoing rule.
The incoming policy is from the tunnel remote address subnet 172.x.x.x /22 to a group of the individual Virtual IP's I created.
This is testing properly currently but I wasn't sure if the one to one IP Pool on the outgoing policy is necessary. I am assuming that the individual Virtual IP's are using their numbers assigned (which are inclusive of the IP Pool). Is this muddying the waters or a necessary part of the tunnel communications?
Let me know if anyone needs further info and thanks for any help you can provide.
Posted Mar 6, 2026, 9:49 PM UTC