Massive static NAT translations

Similar Questions

• Cannot ping via the VPN client host when static NAT translations are used

  Hello, I have a SRI 3825 configured for Cisco VPN client access.

  There are also several hosts on the internal network of the static NAT translations have a services facing outwards.

  Everything works as expected with the exception that I cannot ping hosts on the internal network once connected via VPN client that is internal IP addresses have the static NAT translations in external public addresses, I ping any host that does not have static NAT translation.

  For example, in the example below, I cannot ping 192.168.1.1 and 192.168.1.2, but I can ping to the internal interface of the router, and any other host on the LAN, I can ping all hosts in the router itself.

  Any help would be appreciated.

  Concerning

  !

  session of crypto consignment

  !

  crypto ISAKMP policy 10

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group vpnclient

  key S3Cu4Ke!

  DNS 192.168.1.1 192.168.1.2

  domain domain.com

  pool dhcppool

  ACL 198

  Save-password

  PFS

  netmask 255.255.255.0

  !

  !

  Crypto ipsec transform-set-SECURE 3DES esp-3des esp-sha-hmac

  !

  Crypto-map dynamic dynmap 10

  86400 seconds, life of security association set

  game of transformation-3DES-SECURE

  market arriere-route

  !

  card crypto client cryptomap of authentication list drauthen

  card crypto isakmp authorization list drauthor cryptomap

  client configuration address card crypto cryptomap answer

  map cryptomap 65535-isakmp ipsec crypto dynamic dynmap

  !

  interface GigabitEthernet0/0

  NAT outside IP

  IP 1.2.3.4 255.255.255.240

  cryptomap card crypto

  !

  interface GigabitEthernet0/1

  IP 192.168.1.254 255.255.255.0

  IP nat inside

  !

  IP local pool dhcppool 192.168.2.50 192.168.2.100

  !

  Note access-list 198 * Split Tunnel encrypted traffic *.
  access-list 198 allow ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255

  !
  Note access-list 199 * NAT0 ACL *.
  access-list 199 deny ip 192.168.0.0 0.0.255.255 192.168.0.0 0.0.255.255
  access-list 199 permit ip 192.168.1.0 0.0.0.255 any

  !

  Sheep allowed 10 route map
  corresponds to the IP 199

  !
  IP nat inside source map route sheep interface GigabitEthernet0/0 overload

  !

  IP nat inside source static 192.168.1.1 1.2.3.5
  IP nat inside source static 192.168.1.2 1.2.3.6

  The problem seems to be that static NAT take your nat exemption.

  The solution would be:

  IP nat inside source static 192.168.1.1 1.2.3.5 sheep map route
  IP nat inside source static 192.168.1.2 1.2.3.6 sheep map route

  HTH

  Herbert

• NAT problem? Large amount of NAT translations.

  I have a client with a particular site who complains constantly of performance.

  They have a 871 at the location remote with 4 tunnels IPsec, built over WAN connections to their provider hosting the database and software.

  There are about 50 people who work at this place, but I show 3410 current connections with a peak of 14703. I don't see how that's possible with only 50 people and starts to lean towards the NAT config which can be the cause of the poor performance that users encounter.

  Auffen_Washington #show ip nat statistics
  Total active translations: 3410 (static, dynamic 0 3410; 3410 extended)
  Translations of crete: 14703, took place there is 2d05h
  External interfaces:
  FastEthernet4, Tunnel401, Tunnel0, Tunnel11, Vlan3, Tunnel101, Tunnel201
  Tunnel301
  Interfaces in reverse:
  Vlan1, Vlan2
  Hits: 574573468 Misses: 0
  CEF translated packages: 566630850, CEF punted packets: 45186206
  Expiry of the translations: 10381404
  Dynamic mappings:
  -Source inside
  [Id: 1] access-list interface Loopback1 refcount NAT_Wireless_DMS 0
  [Id: 2] NAT_Failover interface Vlan3 refcount route map 0
  [Id: 3] NAT_Primary interface FastEthernet4 refcount 3410 route map
  Doors appl: 0
  Normal doors: 0
  Queuing of packets: 0

  Any help would be greatly appreciated.

  Thank you

  Russell Stamey

  NAT translations, by default, remain active for a very long time. If I remember correctly, is 24 hours, but I have to what to look for to be sure. They don't take a lot of memory, so this isn't normally a problem, but if you encounter conditions that you think may be due to this, it is quite easy to limit the wait time.

   ip nat translation timeout 1800

  This will set the timeout for new connections to half an hour. Existing connections will always keep the original deadlines, then you might want to wait a period of slow to change and the issue a "clear the ip nat translation *" right then to clear existing translations.

• Static NAT by ASA

  I configured a static NAT through my ASA, which for some

  reason does not work - I think that the problem is with the NAT or

  der rather than the rule itself, but I would be very grateful if someone

  could you help me diagnose the problem.

  command line, the rule is: -.

  static (UKSCMGMT, management) 10.20.20.20 192.168.1.2 255.255.255.255 subnet mask

  My theory is that anything with a destination address of 10.20.20.20 would be considered to be 192.168.1.2 on the UKSCMGMT interface.

  in looking at ASDM rule looks like this

  Type the address of the Source Destination interface trans

  Static empty management 192.168.1.2 10.20.20.20

  There are a few rules exemption related to 192.168.1.2 - but they are host-to-host and should not affect the static translation.

  Yes, quite correct. You can configure NAT exemption by network instead of by each host. If you have guests that can be grouped in a subnet, configure as network instructions instead.

• Public static political static NAT in conflict with NAT VPN

  I have a situation where I need to create a VPN site-to site between an ASA 5505 using IOS 7.2 and a Sonicwall NSA4500. The problem arises where the LAN behind the Cisco ASA has the same subnet an existing VPN currently created on the Sonicwall. Since the Sonicwall cannot have two VPN both run on the same subnet, the solution is to use policy NAT on the SAA as well as for the Sonicwall, the new VPN seems to have a different subnet.

  The current subnet behind the ASA is 192.168.10.0/24 (The Sonicwall already has a private network virtual created for another customer with the same subnet). I try to translate it to 192.168.24.0/24. The peer LAN (behind the Sonicwall) is 10.159.0.0/24. The ASA relevant configuration is:

  interface Vlan1

  IP 192.168.10.1 255.255.255.0

  access extensive list ip 192.168.24.0 outside_1_cryptomap allow 255.255.255.0 10.159.0.0 255.255.255.0

  list of access VPN extended permit ip 192.168.10.0 255.255.255.0 10.159.0.0 255.255.255.0

  public static 192.168.24.0 (inside, outside) - list of VPN access

  card crypto outside_map 1 match address outside_1_cryptomap

  In addition, there are other static NAT instructions and their associated ACLs that allow certain traffic through the firewall on the server, for example:

  public static tcp (indoor, outdoor) interface smtp SERVER smtp netmask 255.255.255.255

  The problem is this: when I enter the static strategy statement NAT, I get the message ' WARNING: real-address conflict with existing static "and then it refers to each of the static NAT statements reflecting the external address to the server. I've thought about it, and it seemed to me that the problem was that policy NAT statement must be the first statement of NAT (it is the last one) so that it is run first and all traffic destined to the VPN to the Sonicwall (destination 10.159.0.0/24) tunnel would be properly treated. If I left him as the last statement, then the other static NAT statements would prevent a part of the 10.159.0.0/24 network-bound traffic to be correctly routed through the VPN.

  So, I tried first to my stated policy NAT upward in the ASDM GUI interface. However, moving the declaration was not allowed. Then I tried to delete the five static NAT statements that point to the server (an example is above) and then recreate them, hoping that would then move up the policy statement NAT. This also failed.

  What Miss me?

  Hello

  I assumed that we could have changed the order of the 'static' , the original orders, but as it did not work for some reason any then it seems to me that you suggested or change, that I proposed should work.

  I guess that your purpose was to set up static political PAT for the VPN for some these services, then static PAT of public network access, then static NAT to policy for the rest of the network in-house.

  I guess you could choose any way seems best for you.

  Let me know if get you it working. I always find it strange that the original configuration did not work.

  Remember to mark a reply as the answer if it answered your question.

  Feel free to ask more if necessary

  -Jouni

• Static NAT problem with PIX501

  Hi all

  We have problems with our PIX firewall. We have configured PIX 501 with static NAT for our Web server. Here's the running configuration.

  6.3 (4) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  pixfirewall hostname

  domain ciscopix.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list 101 permit tcp any host x.x.x.26 eq www

  access-list 101 permit tcp any host x.x.x.26 EQ field

  access-list 101 permit udp any host x.x.x.26 EQ field

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside x.x.x.28 255.255.255.248

  IP address inside 192.168.90.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.90.0 255.255.255.0 inside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) x.x.x.26 192.168.90.3 netmask 255.255.255.255 0 0

  Access-group 101 in external interface

  Route outside 0.0.0.0 0.0.0.0 x.x.x.25 1

  Route inside 192.168.1.0 255.255.255.0 192.168.90.2 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.90.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  Terminal width 80

  : end

  the problem is the configuration, we are unable to access the web server both inside and outside the network.

  All input will be greatly appreciated.

  Kind regards

  udimpas

  activate icmp backtrace and then ping the x.x.x.26 of the internet. the output should be as below:

  3363574:-out ICMP echo request: ID = 21834 seq = 1202 length = 80

  3363575: ICMP echo request: external untranslating: inside: 192.168.90.3

  3363576: ICMP echo-reply from the inside: 192.168.90.3 ID = 21834 seq = 1202 length = 80

  3363577: response to ICMP echo -: translate inside: 192.168.90.3 out:

  by doing this, you can 1. Check the nat 2. If the server responds to the internet.

  do not forget to allow incoming icmp:

  access-l 101 permit icmp any one

• 2 static NAT on the same Interface

  I have an ASA 5510 (8.2 (5)) and I'm trying to set up a VPN site-to site of one of our suppliers.  The problem I am running into is that they want me NAT one specific to one of our servers private IP, and this server already has a static NAT from the outside of a demilitarized zone.  It's the current rule NAT:

  static (DMZ1, external) 65.43.x.x 10.0.0.3 netmask 255.255.255.255

  and they want card me 172.28.9.42 on the same server, so I tried to add:

  (DMZ1, external) 172.28.9.42 static 10.0.0.3 netmask 255.255.255.255

  but can not because it's a double translation.

  Any help would be greatly appreciated.

  Hello

  It seems to me you must configure a static NAT to politics

  Configurations would be as follows

  DMZ-POLICY-NAT of ip 10.0.0.3 host allowed access list

  (DMZ1, external) 172.28.9.42 static access-list DMZ-POLICY-NAT

  Regarding configurations

  • Name of the ACL can be naturally you want
  • Destination network can be a single host if necessary IP address
  • You should be able to configure multiple lines if necessary

  Note that you need to have this NAT configuration before the real public IP address command static NAT. You need to remove the existing static NAT to configure the above and add the original.

  This is because if you do not configure static NAT of politics first in the configuration, all traffic will keep hitting the normal rule of the static NAT for the public IP address.

  -Jouni

• Two static NAT/PAT instructions

  Hello

  I have a PIX 515 running PIX OS 7.0, and I have a server behind the PIX with a static translation entry.

  I was invited as a remote site must connect to the SQL service running on this computer, but the site connects to a non Standard-SQL TCP port, so I thought that I can use a static PAT (port forwarding), but I wonder... can I keep the existing static NAT and add the static PAT? !!! Furthermore, the rest of the remote sites will connect to the same SQL service on the standard port and there are more services running on the server that will be accessible from the outside.

  The server is online, so I won't add the static PAT before you make sure that it will run smoothly...

  Thnx, Salem.

  Hi Salem,

  First, I entered this static NAT command:

  static (inside, outside) 1.2.3.4 10.0.0.1 netmask 255.255.255.255

  This static PAT order tracking:

  static (inside, outside) tcp 1.2.3.4 http 10.0.0.1 netmask 255.255.255.255 http

  and got this error message:

  ERROR: mapped address conflict with existing static

  This suggests that it is not possible.

  Kind regards

  Tom

• VPN with static nat for a whole subnet

  Hey there,

  For some reason, I can't do this on the router. Errrr...

  I'm trying to config a static nat (many to one), which will be in effect only when traffic needs to go on our vpn tunnel to the remote location.

  example:

  internal LAN 192.168.0.0

  remote network: 10.10.10.0 and 10.10.15.0

  When traffic passes over the tunnel vpn - at the remote site, I need to translate my internal network (192.168.0.0) to an ip address 172.16.32.65 static

  any ideas?

  also on my crypto map ACL, which must be specified for interesting traffic? my local network or static ip address search?

  Let me know your thoughts on the matter.

  Kind regards

  R.

  NAT you describe is named PAT or overload, at least in terms of Ciscos...

  What you need:

  (1) a NAT - ACL when you describe your traffic which should be natted.

  (2) a nat pool with your 172.16.32.65 address

  (3) a statement-NAT for dynamic NAT inside based on the ACL for the pool

  Here are some examples:

  http://www.Cisco.com/en/us/docs/iOS/ipaddr/configuration/guide/iadnat_addr_consv_ps10591_TSD_Products_Configuration_Guide_Chapter.html#wp1073436

  Your crypto ACL then referred to the NATted IP as NAT happens before encryption.

• Static NAT to 10.140.2.0 to 10.240.2.0 via VPN

  I need help to set up a static nat device between oursite and seller

  oursite has a subnet 10.140.2.0/24 the provider uses for something else.  They asked that we nat 10.140.2.0/24 to 10.240.2.0/24 via the VPN, so they will see the 10.140 10.240? any help is appreciated. I think that map crypo acl must be standing as well, we run version 8.2

  LOCAL SITE - ASA - TUNEL VPN - ASA - SITE PROVIDER

  Thanks in advance

  Hello Bbftijari,

  In this case, according to the ASA version, but you will need to configure, this way:

  Pre - 8.3

  1. create groups of objects for use in the ACL,

  the LOCAL_SITE object-group network
  object-network 10.140.2.0 255.255.255.0

  the Vendor_SITE object-group network
  network-object XXXXXX XXXXXX

  2. create ACLs, as a condition,

  access-list VPN_NAT permitted object-group LOCAL_SITE object group ip Vendor_SITE

  3 create the static NAT, call the ACL, so he says "when I come inside outside of LOCAL_SITE to Vendor_SITE, I will result in 10.240.2.0/24.

  public static 10.240.2.0 (inside, outside) access-list VPN_NAT netmask 255.255.255.0

  --------------------------------------------------------------------------------------------------------------------------------

  Post 8.3

  1 create the network objects and create a static entry:

  the LOCAL_SITE object-group network
  object-network 10.140.2.0 255.255.255.0

  the NAT_SITE object-group network
  object-network 10.240.2.0 255.255.255.0

  the Vendor_SITE object-group network
  network-object XXXXXX XXXXXX

  2. static NAT creation,

  NAT (inside, outside) 1 static source LOCAL_SITE NAT_SITE Vendor_SITE Vendor_SITE non-proxy-arp-search of route static destination

  Test and keep me posted.

  Please note and mark it as the correct answer if it helped you.

  David Castro,

• Static Nat issue unable to resolve everything tried.

  Hello

  I have a cisco asa 5515 with asa worm 9.4.1 and asdm 7.4

  I have problem with configuring static nat, I have a server inside which ip is 172.16.1.85 and

  my external interface is configured with a static ip address.

  Internet works fine but cannot configure static nat...

  Here's my config running if please check and let me know what Miss me...

  Thank you

  ASA release 9.4 (1)
  !
  ciscoasa hostname

  names of
  !
  interface GigabitEthernet0/0
  nameif outside
  security-level 0
  IP 151.253.97.182 255.255.255.248
  !
  interface GigabitEthernet0/1
  nameif inside
  security-level 100
  IP 172.16.1.1 255.255.255.0
  !
  interface GigabitEthernet0/2
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/3
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/4
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface GigabitEthernet0/5
  Shutdown
  No nameif
  no level of security
  no ip address
  !
  interface Management0/0
  management only
  nameif management
  security-level 100
  IP 192.168.1.1 255.255.255.0
  !
  boot system Disk0: / asa941-smp - k8.bin
  passive FTP mode
  object remote desktop service
  source eq 3389 destination eq 3389 tcp service
  Description remote desktop
  network of the RDP_SERVER object
  Home 172.16.1.85
  outside_access_in list extended access allow desktop remotely any4 object RDP_SERVER
  pager lines 24
  asdm of logging of information
  Outside 1500 MTU
  Within 1500 MTU
  management of MTU 1500
  no failover
  no monitor-service-interface module of
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 743.bin
  don't allow no asdm history
  ARP timeout 14400
  no permit-nonconnected arp
  !
  network of the RDP_SERVER object
  NAT (inside, outside) interface static service tcp 3389 3389
  !
  NAT source auto after (indoor, outdoor) dynamic one interface
  Access-group outside_access_in in interface outside
  Route outside 0.0.0.0 0.0.0.0 151.253.97.177 1
  Timeout xlate 03:00
  Pat-xlate timeout 0:00:30
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  Floating conn timeout 0:00:00
  identity of the user by default-domain LOCAL
  Enable http server
  http server idle-timeout 50
  http 192.168.1.0 255.255.255.0 management

  Telnet 192.168.1.0 255.255.255.0 management
  Telnet timeout 5
  SSH stricthostkeycheck
  SSH 192.168.1.0 255.255.255.0 management
  SSH timeout 5
  SSH group dh-Group1-sha1 key exchange
  Console timeout 0
  VPDN username bricks12 password * local store
  management of 192.168.1.2 - dhcpd address 192.168.1.254
  enable dhcpd management
  !
  a basic threat threat detection
  Statistics-list of access threat detection
  no statistical threat detection tcp-interception
  dynamic-access-policy-registration DfltAccessPolicy
  username, password imran guVrfhrJftPA/rQZ encrypted privilege 15
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  maximum message length automatic of customer
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  Review the ip options
  !
  global service-policy global_policy
  context of prompt hostname
  anonymous reporting remote call

  ciscoasa #.

  Hello

  Change this ACL: -.

  outside_access_in list extended access allow desktop remotely any4 object RDP_SERVER

  TO

  outside_access_in list extended access allowed object RDP_SERVER eq any4 tcp 3389

  Thank you and best regards,

  Maryse Amrodia

• Dual active/passive failover of ISP with static Nat on Cisco 1941

  Hello world

  I'm working on a configuration of a client and I have everything in place right now except the NAT' static ing.  The config fails during an ISP to another and track als and routes by default static weighted, the PAT rocking with course to each interface maps.  It is, is it possible to switch on the large amount of static NAT entries to the ISP of backup?  So far, everything I've read said no because you can have only one entry per ip/port combo, other than another configuration static NAT double server with a different IP address.  I just want to be sure before making my recommendations, all thoughts are greatly appreciated.

  Thank you

  Brandon

  In fact, you can also long as you use standard NAT ("ip nat inside source static") or not NVI ('ip nat static source') for your attackers. You apply the roadmap by the end of the static NAT statement to indicate which interface it should apply to. So, if you have something like this:

   ip access-list extended ACL_NAT permit ip 192.168.0.0 255.255.255.0 any ! route-map RM_NAT_ISP1 match ip address ACL_NAT match interface GigabitEthernet0/1 ! route-map RM_NAT_ISP2 match ip address ACL_NAT match interface GigabitEthernet0/2 

  Using port 80/tcp for example, you can do this:

   ip nat inside source static tcp x.x.x.x 80 y.y.y.y 80 route-map RM_NAT_ISP1 ip nat inside source static tcp x.x.x.x 80 z.z.z.z 80 route-map RM_NAT_ISP2 

  Just replace x.x.x.x with the LAN address of the machine that you are shipping y.y.y.y with the WAN address you are shipping on isps1 and z.z.z.z with the address of the ISP WAN you are shipping on ISP2. The static NAT will be conditional on the roadmap, at this point.

  This works with TCP, UDP, and IP forwarding, but does not require that you use an IPv4 address to your WAN address. For some reason, it does not work if you use an interface... so if you're using dynamic addresses, it will be more complicated.

• Public static NAT vs. Access-List

  Hello

  I have a question what is the best practice static NAT and access list. Example:

  Server (192.168.1.1) Web inside to outside (10.10.10.10) with the port 80 and 443.

  IP nat inside source static tcp 192.168.1.1 80 10.10.10.10 80

  IP nat inside source static tcp 192.168.1.1 10.10.10.10 443 443

  Or

  IP nat inside source static 192.168.1.1 10.10.10.10

  Access-list 101 permit tcp any host 10.10.10.10 eq 80

  Access-list 101 permit tcp any host 10.10.10.10 eq 443

  interface ethernet0
  IP access-group 101 in

  Thank you

  The operational reasons - it will break things.

• Static NAT enable VPN site-to-site.

  Hello

  We plan to build VPN site to site, but, we have a single public routerable internet IP address to assign VPN on Site A, but Site B is ok.

  in this case, I think that we must use static NAT on the router, the simple diagram is as below.

  internal a subnet - router VPN - router for Internet of the Site - to - VPN - B B Site internal subnet.

  the final goal is to make the communication between internal a subnet and subnet B on IPSEC tunnel.

  OK, as I said, Site A having a public IP address, then it must use the static NAT and need to apply on the Site router.

  Router

  interface x/x

  Head of ESCR to the internet

  NAT outside IP

  !

  interface x/x

  Head of DESC to internal (VPN)

  IP nat inside

  !

  IP nat inside source static (like IP address x.x.x.x) public (as private VPN interface IP x.x.x.x)

  so, wouldn't be work without any problem? I think it will work, but I would find other one just in case.

  Hey,.

  Is that what you try to achieve:

  subnet A - A = vpn router = router B - Sub-B network

  and you need communicate between Subnet A and subnet via ipsec vpn b?

  Concerning

• Static nat and NAT ACL 0

  All,

  I have nat 0 ACL indicating that an ip address should not be natted, while a static nat statement saying we need natted. I just want to know that we will have precedence.

  Thank you

  It is of the order of operations PIX nat / ASA.

  the NAT 0 acl_name (nameif) has priority.

  1 nat 0-list of access (free from nat)

  2. match the existing xlates

  3. match the static controls

  a. static NAT with no access list

  b. static PAT with no access list

  4. match orders nat

  a. nat [id] access-list (first match)

  b. nat [id] [address] [mask] (best match)

  i. If the ID is 0, create an xlate identity

  II. use global pool for dynamic NAT

  III. use global dynamic pool for PAT