156-215.76 · Question #376
You wish to configure an IKE VPN between two R75 Security Gateways, to protect two networks. The network behind one Gateway is 10.1(5)0.0/16, and network 19(2)168.9.0/24 is behind the peer's…
The correct answer is D. None. See the full explanation below for the reasoning.
Question
You wish to configure an IKE VPN between two R75 Security Gateways, to protect two networks. The network behind one Gateway is 10.1(5)0.0/16, and network 19(2)168.9.0/24 is behind the peer's Gateway. Which type of address translation should you use to ensure the two networks access each other through the VPN tunnel?
Options
- AHide NAT
- BStatic NAT
- CManual NAT
- DNone
How the community answered
(37 responses)- A3% (1)
- B5% (2)
- C14% (5)
- D78% (29)
Community Discussion
5
Samuel O.Nov 6, 2025The correct answer is D, None. When you set up a site-to-site VPN between two Check Point gateways, the encryption domain on each side is defined by the actual network addresses behind each gateway, and those real addresses are what get matched against the VPN domain to determine whether traffic goes through the tunnel. If you slap NAT on top of that, you break the domain matching because the translated address no longer falls inside the encryption domain, and the tunnel either drops the traffic or routes it in the clear. The whole point of a VPN is to carry the original IP space securely between sites, so you leave address translation out of the picture entirely and let the tunnel do its job.
Mei-Ling H.Nov 8, 2025The way I read this, the VPN encryption domain is built around the actual subnet addresses, so applying any NAT would rewrite the source or destination IP before the tunnel checks it, and then the packet would not match the encryption domain at all, which is why the answer is D. But I am not 100% clear on this: if the two networks happened to overlap in address space, would you then need Manual NAT or Static NAT to make the VPN work, or does Check Point handle that a completely different way?
Orla P.Nov 10, 2025Your read on the encryption domain is exactly right, and on overlapping subnets, yes, Manual NAT (specifically hide or static NAT applied before the encryption domain lookup) is the standard Check Point fix, because you remap one side's addresses so the tunnel can distinguish traffic that would otherwise be ambiguous.
Brenda K.Nov 13, 2025Flag it, come back, clock saved me: no NAT needed between VPN peers. Real exam I almost bubbled C before noticing the networks don't overlap at all.
Orla P.Nov 26, 2025NAT is the right call here, and that is exactly why you pick None. VPN encryption domains are defined by the actual IP ranges on each side, so if you NAT the traffic before it hits the tunnel, the Gateway encrypts the wrong source addresses and the peer rejects the packets because they fall outside the declared encryption domain.