Great scenario walk-through, explains the dual-NAT process very well. Question I have is would this work for multiple 3rd party sites connecting into the same VPNGW, who have the same overlapping IP address space or would a vendor based NVA solution be more suitable? (Trying to avoid sharing the BGP routing table with all these potential 3rd parties as well) Just trying to develop a pattern which will scale without causing NAT and routing challenges later. Love the material and scenario's you are covering here and in GitHub...keep it up! :)
If you ever found a good, scalable way to do this that doesn't share the BGP routing table for your whole trusted network, I would love to know - cheers
Question about the public IPs used -- if BGP is advertising a route for the entire 100.0.0.0/24, does that break traffic from on-prem resources to any other host on the internet on that subnet?
Very nice, but you are not showing the local network gateway configuration which is kind of confusing on how the onprem info is set. Can you update on that?
Hi Adam. I'm having a problem when I configure NAT on the Azure VPN gateway from a 10.70.0.0/20 network to a 100.70.0.0/20 network. When I configure this 100.70.0.0/20 network inside the firewall, it doesn't work. The NAT only works if I also enter the 10.70.0.0/20 network into the local firewall (Fortigate). However, since these networks already exist, I can't enter the entire range into the firewall. I only configured an static egress rule in the NAT.
These Nated IPs do I just use any IP or I would have to created a public IP or a private subnet IP to be used for this. How did you get these Nated IPs
Great video, but I have a question: how do you make sure on-prem resources can resolve Azure VMs with on-prem IPs ? The on-prem DNS is not aware of NAT
This is certainly not something you should be rolling out en masse, rather something to get you out of a hole. Agree DNS is a concern which is going to require manual work. In my experience, this is for connections between third parties, who are generally runnning their own DNS infra anyway.
Hi Adam i am using vpngw1 sku which doesn't support nat rules not the second method its only for one vm not for entire resources. Route tables not suggested by azure for vpn gateway. Any suggestions from you.
Such awesome work! One query which keeps on hitting my mind. how this mapping happens on backend. Lets say if have couple to backend IPs to be reached. which corresponds NATTED IP to be reached from other side. Can some one please help to understand.
