NAT Gateway for External IP with Cloud VPN Connection to On-Premises Cisco Flex VPN

[Aidap]

Hello 

We are struggling with this case scenario. We want to connect our GCP VM through Cloud VPN to customer Cisco Flex VPN on-premise. We followed Google Docs to create a classic VPN with the VPN tunnel and VPN Gateway up. The customer only accepts the external IP address from us, so we needed to add the external IP address; we tried to Nated inside the VM by using the following command : 

$ sudo iptables -t nat -A POSTROUTING --destination REMOTE_PEER_SUBNET -j SNAT --to-source EXTERNAL_IP_ADDRESS

But we had no luck because the traffic was still routed through the primary internal IP address, so I did the following : 

• VM Configuration:
  • The VM  with no external IP.

• Cloud Router with NAT Gateway:
  • A Cloud Router is set up within the same Network as the VM and accepts all the internal IP ranges 
  • A NAT Gateway is configured to provide an external IP. ( status is ok ) 
• Static Route:
  • A static route is established to ensure Destination traffic is routed through the VPN. ( the route is up) 

{
  "creationTimestamp": "2024-07-18T21:49:01.780-07:00",
  "description": "",
  "destRange": "Destination EXternal IP /32",
  "id": "XXXXXX",
  "kind": "compute#route",
  "name": "route-to-on-premise",
  "network": "Dedicated network for this ",
  "nextHopVpnTunnel": "vpnTunnels", ( please note you can't add the VPN gateway as google only support IGW) 
  "priority": 1000,
  "selfLink": "XXX"
}​

• VPN Gateway:
  • Created the VPN Gateway is configured with the destination gateway. ( running ) 
• Tunnel Configuration:
  • The tunnel is set up with the destination IP range. ( tunnel has been established ) 
  • The source IP address for the tunnel is the external IP provided by the NAT Gateway.

Status
Tunnel is up and running.

But when we run the network connectivity test, we get the following error :

Configuration analysis aborted
Aborted because no endpoint with the packet's destination IP address (EXTERNAL-IP): is found

Also, we can't make curl requests to the customer endpoints, but we also get the time out.