Solutions for Overlapping IP addresses in Azure (VPN Gateway NAT / Private Link Service)

[@rodrigo16medeiros]

This is the kind of video I like the most, that shows how things work behind the scenes. Thank you for the effort to make things clear!

[@ketanshah9082]

Thank you so much Adam Sir! Videos like these help understand the concepts much easier than reading articles alone. Appreciate all your efforts!

[@punneethkammili]

Extremely useful Video Adam. Solved many client worries for us.

[@boarderstu]

This is great thanks! Looking at a S2S option for a client, and this looks like, possibly the less complicated route!

[@AdamStuart1]

There is also now Azure Firewall option, will do a video on this at some point techcommunity.microsoft.com/t5/azure-network-security-blog/private-ip-dnat-support-and-scenarios-with-azure-firewall/ba-p/4230073?trk=feed-detail_main-feed-card_feed-article-content

[@boarderstu]

@@AdamStuart1 both interesting and expensive!

[@georgeollis]

Great video as always Adam.

[@QuickHits]

An excellent explanation. Absolutely brialliantly clear. (Mark G - Microsoft)

[@dmitriyshmuylovskiy3622]

Putting on-prem aside, is there a way to leverage NATing with overlapping IP ranges in Azure spokes?

[@gowthaman.s]

thank you .technically very informative as a network engineer

[@MrOcsicman]

Great scenario walk-through, explains the dual-NAT process very well. Question I have is would this work for multiple 3rd party sites connecting into the same VPNGW, who have the same overlapping IP address space or would a vendor based NVA solution be more suitable? (Trying to avoid sharing the BGP routing table with all these potential 3rd parties as well) Just trying to develop a pattern which will scale without causing NAT and routing challenges later. Love the material and scenario's you are covering here and in GitHub...keep it up! :)

[@benjaminmarch3420]

If you ever found a good, scalable way to do this that doesn't share the BGP routing table for your whole trusted network, I would love to know - cheers

[@adrianromero1615]

Very nice, but you are not showing the local network gateway configuration which is kind of confusing on how the onprem info is set. Can you update on that?

[@christopherjohnson1766]

Question about the public IPs used -- if BGP is advertising a route for the entire 100.0.0.0/24, does that break traffic from on-prem resources to any other host on the internet on that subnet?

[@HelvertonJunior-ux9hl]

Hi Adam. I'm having a problem when I configure NAT on the Azure VPN gateway from a 10.70.0.0/20 network to a 100.70.0.0/20 network. When I configure this 100.70.0.0/20 network inside the firewall, it doesn't work. The NAT only works if I also enter the 10.70.0.0/20 network into the local firewall (Fortigate). However, since these networks already exist, I can't enter the entire range into the firewall. I only configured an static egress rule in the NAT.

[@peppe6511]

Whic will be the proxy-id/cryptomap to define on third-parti firewall? Any to Any?

[@5ive762]

Awsome Tutorial

[@francescorusso5982]

Great video, but I have a question: how do you make sure on-prem resources can resolve Azure VMs with on-prem IPs ? The on-prem DNS is not aware of NAT

[@AdamStuart1]

This is certainly not something you should be rolling out en masse, rather something to get you out of a hole. Agree DNS is a concern which is going to require manual work. In my experience, this is for connections between third parties, who are generally runnning their own DNS infra anyway.

[@sat5812]

Hi Adam i am using vpngw1 sku which doesn't support nat rules not the second method its only for one vm not for entire resources. Route tables not suggested by azure for vpn gateway. Any suggestions from you.

[@denisdm91]

very useful video, thank you! :) one question: what if we didn't have a spoke network, and it was the hub network in overlay?

[@AdamStuart1]

It would still work fine in that scenario, I used a separate spoke to make it a little clearer, and allow easier connect/disconnect.

[@wearewhoweare6602]

These Nated IPs do I just use any IP or I would have to created a public IP or a private subnet IP to be used for this. How did you get these Nated IPs

[@nomnoomz]

Thanks, I got it working using private services. Now, if I want to reach the the On-prem from the Private Link Service, is that possible?

[@nomnoomz]

I been having the same question, I don’t think is possible. I recall it’s a one way connection

[@papablopopo]

Thanks Adam

[@deepakchughCoolman]

Such awesome work! One query which keeps on hitting my mind. how this mapping happens on backend. Lets say if have couple to backend IPs to be reached. which corresponds NATTED IP to be reached from other side. Can some one please help to understand.

[@AdamStuart1]

Please elaborate on your question.