IPSec VPN — Overlapping Subnets (X-Pool)

Navigation: Scenarios → IPSec Overlapping Subnets

Build a site-to-site IPSec VPN when local and remote subnets are identical (for example both sites use 192.168.1.0/24). Enable Install Policy on the tunnel, set Phase 2 local and remote networks to the same CIDR, align the inline firewall rule with Phase 2 selectors, apply X-Pool SNAT to translate local sources, and set Destination Interface to the VPN tunnel interface name (tun_ipsec_*).

Critical: Phase 2 Local Networks and Remote Networks must use the same subnet as the real networks — the firewall breaks the overlap with X-Pool NAT, not by changing Phase 2 to the pool range.

Network design

Both Site A and Site B use 192.168.1.0/24. IPSec Phase 2 negotiates 192.168.1.0/24 ↔ 192.168.1.0/24. Before packets enter the tunnel, the local firewall rewrites the source to 10.255.1.0/24 (X-Pool) so the remote site can route replies.

Figure 1 — Identical Phase 2 subnets, X-Pool SNAT, VPN interface on inline rule

Addressing summary

End-to-end flow

1. PC 192.168.1.10 → remote 192.168.1.50
2. Inline rule matches: Source Local_LAN, Dest Remote_LAN, Dest IF = tun_ipsec_3
3. SNAT Policy pool-X rewrites source → 10.255.1.10
4. IPSec Phase 2 encrypts (selectors: 192.168.1.0/24 ↔ 192.168.1.0/24)
5. Remote receives from 10.255.1.10, replies to 10.255.1.10
6. Return de-NAT → 192.168.1.10

Prerequisites

• WAN connectivity to remote peer public IP
• Matching PSK or certificates on both peers
• Agreed X-Pool range (10.255.1.0/24) — must not exist at either site
• Address objects created first

Step 1 — Create address objects

Go to Aliases & Objects → Address:

Phase 2 and firewall policy both reference 192.168.1.0/24. The address object names may differ (Local_LAN, Remote_LAN) but the CIDR must be identical to Phase 2.

Step 2 — Create IPSec VPN tunnel

1. Go to VPN Tunnels → IPSec VPN → + Add New.

General tab — enable Install Policy

Install Policy auto-creates inline rules (for example to ipsec / in ipsec) when the tunnel is saved. You will edit the outbound rule to add X-Pool SNAT.

Endpoints tab

Phase 1 (IKE) tab

Phase 2 (Child SAs) tab — identical local and remote subnets

Click + Add Row:

Both selectors show 192.168.1.0/24 — this is required when both sites share the same subnet.

4. Click + Create Record.
5. When the tunnel comes up, note the VPN interface name on the dashboard (for example tun_ipsec_3 (Branch_Overlap_VPN)).

See IPSec VPN.

Step 3 — Phase 2 vs firewall policy alignment

When Install Policy is enabled, TOORCE creates firewall rules that must mirror Phase 2 selectors. Source uses the real local subnet; destination uses the Phase 2 remote network object.

Source = real local address: The rule source is the actual LAN subnet (192.168.1.0/24), not the X-Pool. X-Pool translation happens in SNAT Policy on the NAT/SDWAN tab after the rule matches.

Step 4 — Edit outbound inline rule (LAN → VPN)

Go to Rules & Policies → Inline Rules. Edit the auto-created outbound rule (for example to ipsec) or create manually:

General

Interfaces

Destination Interface must be the VPN interface name (tun_ipsec_*), not WAN.

Source tab

Destination tab

NAT/SDWAN tab — X-Pool SNAT

Available SNAT policies typically include:

5. Click Save Changes.

For inbound traffic (remote → local) and DNAT with X-Pool, see X-Pool Overlapping NAT.

Step 5 — Install Policy (apply to running firewall)

1. Click Install Policy in the top bar (same action after tunnel or rule changes).
2. Confirm the tunnel is up and tun_ipsec_* shows traffic on the dashboard.

Step 6 — Verify connectivity

Configuration checklist

Troubleshooting

Related documentation

• IPSec VPN
• X-Pool Overlapping NAT — DNAT for inbound / published services
• Inline Rules
• Address Objects
• Static Routes