Site-to-site VPN Translation (1:M) – behaves like source NAT from destination side?

[giovanitestoni]

Hi all,

Quick question to validate my understanding of Site-to-site VPN Translation (1:M) on MX.

In this mode:

• Multiple internal prefixes / hosts are translated

• Traffic is NATed to a single /32 address

• From the remote site perspective, all traffic appears to come from one source IP

So effectively, although documented as 1:many, the behavior on the destination side looks very similar to source NAT (many-to-one):

• The destination only needs to route and permit a /32

• Original source subnets are not visible for policy enforcement

https://documentation.meraki.com/SASE_and_SD-WAN/MX/Design_and_Configure/Configuration_Guides/Site-t...

Does this match your experience with Auto VPN translation?

Thanks!

[PatWruk]

If I remember right, it's been a while since I've used it. You set the translation NAT to match the subnet size of the source network. So if you're source network is 10.1.1.0/24 but you want to use 10.25.10.0/24 through the translation. A device in your original network using the IP 10.1.1.27 would come through the translation as 10.25.10.27, essentially using the same last octet but being translated to the new subnet.

[alemabrahao]

Yes, this is correct.