Create forwarding rules on hub gateways for policy-based VPNs

Create rules for forwarding policy-based VPN traffic from one tunnel to another and for forwarding tunneled traffic to the Internet.

1. To forward policy-based VPN traffic from one tunnel to another, insert the following type of rule:

   Table 1. Basic rule for forwarding policy-based VPN traffic

   Source	Destination	Service	Action	Source VPN
   Addresses in remote (spoke) networks as needed.	Addresses in remote (spoke) networks as needed.	Set as needed.	Select Allow, then open the Action options. Set VPN Action to Forward, then select a Policy-Based VPN.	Select Match traffic based on source VPN, then add one or more Policy-Based VPN elements according to where the traffic is coming from.

2. To forward tunneled traffic to the Internet, insert the following type of rule:

   Table 2. Rule for allowing traffic except if it arrives through policy-based VPNs

   Source	Destination	Service	Action	Source VPN
   Set as needed.	Set as needed.	Set as needed.	Allow.	Select Match traffic based on source VPN, then add one or more Policy-Based VPN elements according to where the traffic is coming from. This rule does not match traffic from other sources.

   In most cases, the source IP addresses are from a private address space. You must add a NAT rule to translate them to publicly routable IP addresses. Make sure that NAT is enabled in the properties of the Policy-Based VPN element. Add a NAT rule for the VPN traffic if a suitable NAT rule does not exist already.
3. Create a VPN rule that directs all traffic to the policy-based VPN with the hub gateway.
   Note: For the traffic to be allowed into the VPN, the destination IP address must be part of the Site definition of the hub gateway. When you forward Internet traffic, the hub’s Site must usually include the Any Network element. This Site can interfere with other VPN configurations. We recommend disabling it in other VPNs.