@IMC10 

One-to-One NAT is only possible on WAN interfaces with a static IP, since your ISP is PPPoE i assume its DHCP on the WAN ?

  @GRL  That makes a lot of sense. I hadn't realised the SDN controller would filter the One-to-One NAT menu based on the WAN type, but as this is a PPPoE connection, that explains why the interface dropdown is empty.

I might be misremembering how I had it set up in standalone mode as I was testing a few different configurations behind another router at the time.

Since the equipment isn't on-site yet, I think the best move is to just configure the 172.23.24.0/24 range natively on the local VLAN. It removes the need for NAT entirely and should be a much cleaner setup for the VPN tunnel anyway.

Thanks for clarifying the menu issue, it's saved me a lot of head-scratching!

  @GRL 

Just to clarify, the public IP is static, but Zen deliver it via PPPoE. So the WAN is PPPoE with DHCP. The tunnel to the Palo Alto is up and established without issue.

The challenge is that I need to perform a subnet translation before traffic enters the IPsec tunnel. The remote side expects 172.23.24.0/24 as the local encryption domain, but the machinery on-site is fixed at 172.16.0.0/24 and the client on the other end is being very resistant to changing their configuration.

Ideally I would simply readdress the local VLAN to 172.23.24.0/24 and remove NAT entirely, but politically that is not currently an option.

Because the WAN is PPPoE, the SDN controller hides the One-to-One NAT menu. I have looked at:

- Virtual WAN as a possible static alias workaround

- Policy routing to steer traffic into the tunnel

- Using Custom IP versus Network in the VPN policy

- Creating a transit VLAN locally and trying to bridge with NAT

Unfortunately without access to One-to-One or Multi-Net NAT in controller mode, I cannot build the required SNAT rule.

Is there any supported way to perform policy-based NAT for IPsec when the WAN interface is PPPoE in SDN mode? Even via CLI or advanced configuration?

I am at the point of considering replacing the gateway with a FortiGate purely to get proper policy NAT control, so any suggestions before I go down the rip and replace route would be very welcome.