IPSec BINAT (NAT before IPSec)

Assume company A has local LAN and company B has local LAN Also we assume that on both sides the other networks are already in use, e.g. in company A the network is used for Voice and in company B network is used for Guest Wi-Fi.

We have to define new networks for the Phase 2 with unused ones and create NAT entries to reach the final systems.

To make it easier we create a Phase2 with company A using as Local Network and as Remote Network and with company B using as Local network and as Remote Network. Now we need to add on each side the local LAN in the field “Manual SPD entries”. So for company A we set in the field and for B This allows the NAT process to speak with the Security Policy Database.

Finally we have to create NAT entries since a client in LAN A ( tries to reach, but this address has to be rewritten to on Firewall B.


When using multiple phase 2 entries per tunnel, NAT before IPsec is not supported due to the fact that our SP database doesn’t know which entry to send the traffic to. For more context, please refer to setkey and this ticket on GitHub

Create the rule like in the screenshot and vice versa on Firewall A: