1. Home
  2. Cisco Systems
  3. VPN with NAT on PIX

VPN with NAT on PIX

Hi all, I must create a site-to-site VPN with a customer X that has in its internal network the same ip range of my *inside* interface. My VPN peer is a PIX 515 ver 6.2(2). I have already done some tunnels with other customers and I have always used their real private IPs in my encryption domain; the other point is that customer X has to reach few servers in my LAN and probably a static nat is needed. X provides me the subnet it's going to use to NAT its PCs when they search for my servers, so the static NAT should be applied ONLY if the destination belong to customer X range.

This is the interfaces list:

- inside (192.168.0.0/22)

- DMZ (192.168.200.0/24)

- alpha (private range)

- TELECOM (public range)

The overlapping is for inside and DMZ

The running configuration about nat is

nat (DMZ) 0 access-list NatZeroDmz nat (DMZ) 1 192.168.200.0 255.255.255.192 0 0 global (DMZ) 1 192.168.200.100-192.168.200.253 netmask 255.255.255.0 global (DMZ) 1 192.168.200.254 nat (inside) 0 access-list NatZero nat (inside) 1 0.0.0.0 0.0.0.0 0 0 global (TELECOM) 1 interface

Obviousily crypto map is applied on TELECOM

Can I manage this new scenario ? Will the changes heavily affect the others connections ?

Thank you for your help!

Reply to
marco74
Loading thread data ...

I guess that the solution is policy NAT, on Cisco documentation the command for static NAT sounds like:

access-list NET1 permit ip host 10.1.2.27 209.165.201.0 255.255.255.224 access-list NET2 permit ip host 10.1.2.27 209.165.200.224

255.255.255.224 static (inside,outside) 209.165.202.129 access-list NET1 static (inside,outside) 209.165.202.130 access-list NET2

it shouldn't impact on what is already running (I hope). I'll let you know

Reply to
marco74

Oh, oh ... ver 6.3 is needed for policy natting. The question is: is this a so strange scenario ??? Why Cisco don't give a way to solve this problem even with a 6.2 version ?

Reply to
marco74

I think I found a solution: I tested that the "no nat" (ID 0) is stronger that a static, so I made a simple static between inside and TELECOM for each of my servers (upon a range given by the customer); than the interesting traffic for this new vpn is NOT included in the NatZero ACL. In this way the translation is not applied for the old tunnels and it's done for the new one. I was lucky because my 3 hosts haven't a public nat.

Reply to
marco74

It works (after some clear cry isakmp sa)

Reply to
marco74

Cabling-Design.com Forums website is not affiliated with any of the manufacturers or service providers discussed here. All logos and trade names are the property of their respective owners.