Cisco VPN Client Nat

Hi Kilgore,

There are the two ways to allow traffic to pass through the PIX Firewall without translating the source address:

1. Issue the no nat command.

The nat (inside) 0 0.0.0.0 0.0.0.0 command allows traffic to pass from the inside to the outside without translating the source addresses, but this version of the nat 0 command does not allow for any outside-to-inside traffic.

The nat (inside) 0 access-list nonat command allows traffic to pass from the inside to the outside and also provides an option to permit outside-to-inside traffic based on the nonat Access Control List (ACL), an ACL applied to the outside interface.

1. Issue the static command.

The static (inside,outside) 10.10.10.0 10.10.10.0 netmask 255.255.255.0 command creates an xlate table, but there is really no translation taking effect because the addresses are translated to themselves.

This solution also provides the option to allow outside-to-inside traffic based on an ACL applied to the outside interface.

Sincerely,

Brad Reese

I'm having the exact same problem. My DHCP pool gives out 10.1.23.x addresses to clients.

The network my client sometimes works at also has a 10.1.23.x network.

They c> > Hi Kilgore,

1. Do not use a pool for VPN that is the same as your internal subnet. For example if the internal subnet was 192.168.0.0/24 I would use the pool of 192.168.1.0/24 for the VPN users.

2. You need to exempt what ever address are in the VPN pool from NAT, For example if your internal subnet is 192.168.0.0/24 and your VPN pool is 192.168.1.0/24 you would write a statement such as:

nat (inside) 0 access-list crypto-map-20 access-list crypto-map-20 permit ip 192.168.1.0 255.255.255.0

HTH.

Agreed. I don't have a control over which facilities my clients visit, or their network setup.

Thanks! I'll give that a try!

Not talking about remote sites your users visits I mean the part of your config that defines the IP pool your users will be assigned an IP address from when they connect.

Line in your config looks like:

ip local pool VPN 192.168.0.200-192.168.0.215 mask 255.255.255.0