NAT - backwards

Have a question or want to start a discussion? Post it! No Registration Necessary.  Now with pictures!

I've never actually seen this done, but I'm positive it can work - I just
can't figure out the syntax: I need to NAT two outside global addresses to
the address of a firewall on one of the LAN interfaces.

This solution is intended to support two different groups of VPN clients in
a primary/failover configuration.  The firewalls serving the VPNs apparently
don't support loopback interfaces, so the VPN clients have to be configured
with the outside IP address of the respective firewalls.  I can't just NAT
all the traffic going through to the firewall because it supports other
services.  After going over several possibilities, the only solution I can
think of is to allocate two host addresses, call them PrimA and PrimB (PrimA
used by clients using site A as their primary, PrimB used by B site
clients), and NAT both of them at their respective sites to their respective
firewalls' outside IP addresses:

(All IP addresses are public, I.e. non-rfc1918, but I use rfc1918 here as

AWAN intfc
ALAN intfc

BWAN intfc
BLAN intfc


I want to NAT both and to the firewall's outside IP

ASite: and both NAT to

BSite: and both NAT to

Is this so simple I can't see it?  Or is this a potential hornets nest?  I'm
having a serious mental block here, I'm sure it's not difficult but I can't
figure it out.

TIA for any assistance!!

m j tierney

Site Timeline