PIX and NAT - T

Similar Questions

• Global PIX and nat settings

  My PIX configuration has two world and two nat settings.

  Global (outside) 1 65.209.4.220 - 65.209.4.253 255.255.255.192 subnet mask

  Global (1 65.209.4.254 255.255.255.192 subnet mask outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  NAT (intf2) 1 0.0.0.0 0.0.0.0 0 0

  I can understand the two commands of nat, more or less, but I can't understand why the two global commands and what they do. Can someone clarify the situation?

  Jim

  [email protected] / * /.

  609-896-2404 x 1279

  Oh I should have read your question more carefully. The 1st World allocates addresses for guests inside and intf2.

  Once the pool is not the address, then it will use the 2nd global and it will now start making Polo and non-originating, as was the case in the 1st world.

  So, indeed, until all the addresses in the global pool are exhausted, all of these hosts will be coordinated. After that, the new hosts come out will be PATed with the adresse.254.

  Hope it clears.

  Thank you

  Christophe

• PIX SMTP NAT or Port based NAT?

  I have what may seem like a strange question...

  I have a client with a PIX and a SMTP server inside their network. They were using a NAT Port basis via the following command (all IP addresses are changed to protect the innocent):

  static (inside, outside) 1.1.1.1 tcp smtp 192.168.0.1 netmask 255.255.255.255 smtp

  It worked well for incoming and outgoing email except to go to particular mail servers. What was going on, it was that they were receiving messages from rebound as below:

  Where IP address 1.1.1.2 combined with overall command of the client.

  Once I changed the nat to use a normal NAT rather than on a port a whole worked well. Download

  static (inside, outside) 1.1.1.1 192.168.0.1 netmask 255.255.255.255

  My question is can I do nat based on the port works for IP addressing in the two directions or am I stuck with the help of a single IP NAT?

  I guess what is happening, is that the NAT based on the port looks only to conversations from the incoming direction (ie the conversation is with port 25 on 192.168.0.1), no conversations from the outgoing direction (ie the conversation is with port 25 on an external IP address).

  Rgds,

  Peter

  Excellent analysis and you are immediately. Just a simple set-config that lack of most people. Try the following:

  static (inside, outside) 1.1.1.1 tcp smtp 192.168.0.1 netmask 255.255.255.255 smtp

  Global 2 1.1.1.1 (outside)

  NAT (inside) 2 192.168.0.1 255.255.255.255

  The static method will match the traffic from port 25 to the mail server. So when your mail server sends outgoing traffic on one port other that the 25, he uses the nat/global configuration you have defined for the other hosts on the inside interface. Who obviously doesn't like the other e-mail server.

  Hope that's clear, but if not, let me know.

  Scott

• 506th PIX, no NAT configuration?

  I'm trying to set up a PIX firewall for devices on a valid IP subnet. It is a 506e, with only two interfaces.

  I can't find an example of config and I was wondering if it's because this isn't a supported configuration.

  Pointers?

  Thank you

  Daryl

  Hello

  What you want to achieve, it is possible and very easy to configure. There is no restriction in terms of having no public address on your inside interface. Although you don't want to do any translation that you still may need a static command.

  The minimum config you need would not be nat 0, as some may think, and it works, but only if the PIX cannot be proxy-ARP for the IPS behind the PIX. If the PIX needs proxy-ARP for these addresses, you must configure this way:

  public static 111.111.111.208 (inside, outside)

  111.111.111.208 mask 255.255.255.240

  If you use this command and remove the

  NAT (inside) 0 command it works fine also. The main difference is that, with the static command in place, the PIX not proxy-ARP for the IPS behind your PIX and how nat 0 commands it doesn´t.

  In case you don't need a proxy-ARP you could do with nat 0, but then you have nat 0 on both interfaces to your PIX, so you must:

  NAT (inside) 0 & nat (outside) 0

  Determine if you need proxy-ARP on your border router:

  Is there a route (with the correct next hop) to your edgerouter pointing to 111.111.111.208/28 or your router think it a connected?

  If your router it's a directly connected subnet for some reason (this reason could be that this router is not a classless ip router) then the router wants to send packets to the MAC address and he asks an ARP. In this case the PIX must proxy-ARP.

  Make proxy-ARp is no problem at all for the PIX, cause if you use my first way of configuration, as described previously, then the PIX not proxy-ARP for all addresses in the static command.

  Don t know if this solves your problem, but this could very well be the case.

  Alternatively, you can edit your config here (don't forget to remove the passwords first then) and we can take a look inside.

  Another thing has in my opinion earlier. It could also be the case that your edgerouter has an ARP table that still contains the mappings for the IP addresses which is now behind your firewall. In this case, you need a clear ARP on your border router.

  I hope this helps.

  Kind regards

  Leo

• Site to Site VPN between PIX and Linksys RV042

  I am trying to create a tunnel between a 506th PIX and a Linksys RV042 vpn .  I configured the Phase 1 and Phase 2 as well as the transformation defined and interested traffic and connected to the external interface, but it will not create the tunnel.  Configurations are as follows:

  506th PIX running IOS 6.3

  part of pre authentication ISAKMP policy 40
  ISAKMP policy 40 cryptographic 3des
  ISAKMP policy 40 sha hash
  40 2 ISAKMP policy group
  ISAKMP duration strategy of life 40 86400
  ISAKMP key * address 96.10.xxx.xxx netmask 255.255.255.255
  access-list 101 permit ip 192.168.21.0 255.255.255.0 192.168.1.0 255.255.255.0crypto map Columbia_to_Office 10 ipsec-isakmp
  crypto Columbia_to_Office 10 card matches the address 101
  card crypto Columbia_to_Office 10 set peer 96.10.xxx.xxx
  10 Columbia_to_Office transform-set ESP-3DES-SHA crypto card game
  Columbia_to_Office interface card crypto outside

  Linksys RV042

  Configuration of local groups
  IP only
       IP address: 96.10.xxx.xxx
  Type of local Security group: subnet
  IP address: 192.168.1.0
  Subnet mask: 255.255.255.0

  Configuration of the remote control groups
  IP only
  IP address: 66.192.xxx.xxx
  Security remote control unit Type: subnet
  IP address: 192.168.21.0
  Subnet mask: 255.255.255.0

  IPSec configuration
  Input mode: IKE with preshared key
  Group Diffie-Hellman phase 1: group2
  Phase 1 encryption: 3DES
  Authentication of the phase 1: SHA1
  Life of ITS phase 1: 86400
     
  Phase2 encryption: 3DES
  Phase2 authentication: SHA1
  Phase2 life expectancy: 3600 seconds
  Pre-shared key *.

  I'm a novice on the VPN. Thanks in advance for your expertise.

  Yes, version PIX 6.3 does not support HS running nat or sh run crypto.

  Please please post the complete config if you don't mind.

  Please also try to send traffic between subnets 2 and get the output of:

  See the isa scream his

  See the ipsec scream his

• Router vpn site to site PIX and vpn client

  I have two on one interface on the pix vpn connections that terminate VPN. client vpn and VPN site-to-site have passed phase one and two and decrypt and encrypt the packets. However as in another post I can not ping through the l2l vpn. I checked this isn't a nat problem a nd two NAT 0 on the pix and the NAT on the router access lists work correctly.

  ISAKMP crypto RTR #show its
  IPv4 Crypto ISAKMP Security Association
  status of DST CBC State conn-id slot
  66.x.x.x 89.x.x.x QM_IDLE 2001 0 ACTIVE

  IPv6 Crypto ISAKMP Security Association

  local ident (addr, mask, prot, port): (192.168.2.0/255.255.255.0/0/0)
  Remote ident (addr, mask, prot, port): (192.168.10.0/255.255.255.0/0/0)
  current_peer 66.x.x.x port 500
  LICENCE, flags is {origin_is_acl},
  #pkts program: 23583, #pkts encrypt: 23583 #pkts digest: 23583
  #pkts decaps: 18236, #pkts decrypt: 18236, #pkts check: 18236
  compressed #pkts: 0, unzipped #pkts: 0
  #pkts uncompressed: 0, #pkts compr. has failed: 0
  #pkts not unpacked: 0, #pkts decompress failed: 0
  #send 40, #recv errors 0

  local crypto endpt. : 89.x.x.x, remote Start crypto. : 66.x.x.x
  Path mtu 1380, ip mtu 1380, ip mtu BID Dialer0
  current outbound SPI: 0xC4BAC5E (206285918)

  SAS of the esp on arrival:
  SPI: 0xD7848FB (225986811)
  transform: aes - esp esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 3, flow_id: Motorola SEC 1.0:3, card crypto: PIX_MAP
  calendar of his: service life remaining (k/s) key: (4573083/78319)
  Size IV: 16 bytes
  support for replay detection: Y
  Status: ACTIVE

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:
  SPI: 0xC4BAC5E (206285918)
  transform: aes - esp esp-sha-hmac.
  running parameters = {Tunnel}
  Conn ID: 4, flow_id: Motorola SEC 1.0:4, card crypto: PIX_MAP
  calendar of his: service life remaining (k/s) key: (4572001/78319)
  Size IV: 16 bytes
  support for replay detection: Y
  Status: ACTIVE

  outgoing ah sas:

  outgoing CFP sas:

  Expand the IP NAT access list
  10 deny ip 192.168.2.0 0.0.0.255 192.168.10.0 0.0.0.255 (21396 matches)
  20 permit ip 192.168.2.0 0.0.0.255 everything (362 matches)
  Expand the IP VPN_ACCESS access list
  10 permit ip 192.168.20.0 0.0.0.255 192.168.10.0 0.0.0.255 (39724 matches)

  I looked on the internet and that it points to a routing error when packets are being encrypted and decrypted, but you can't do a ping on the binding. However when I test the connection I did not enter any of the static routes that networks are connected directly on each side of the pix and the router. any help would be a preciated as I think there's maybe something is blocking the ping to reach the internal network at the end of pix with a configured access list.

  is ping failure of the only thing between the site to site VPN? and assuming that all other traffic works fine since it decrypts and encrypts the packets.

  If it's just ping, then activate pls what follows on the PIX:

  If it is version 6.3 and below: fixup protocol icmp

  If it is version 7.0 and higher: select "inspect icmp" under your political map of the world.

  Config complete hand and on the other could help determine if it's a configuration problem or another problem.

• VPN IPSec with no. - Nat and Nat - No.

  On a 6.3 (5) PIX 515 that I currently have an IPSec VPN configured with no. - nat, using all public IPs internally and on the remote control. Can I add two hosts to the field of encryption that have private IP addresses and NAT to the same public IP in the address card Crypto? What commands would be involved in this?

  Current config:

  -------

  ipsectraffic_boston list of allowed access host ip host PublicIP11 PublicIP1

  ipsectraffic_boston list of allowed access host ip host PublicIP22 PublicIP2

  outside2_outbound_nat0_acl list of allowed access host ip host PublicIP PublicIP

  card crypto mymap 305 correspondence address ipsectraffic_boston
  mymap 305 peer IPAdd crypto card game.
  mymap 305 transform-set ESP-3DES-SHA crypto card game
  life card crypto mymap 305 set security-association seconds 86400 4608000 kilobytes

  ---------

  I would add two IP private to the 'ipsectraffic_boston access-list' and have NAT to a public IP address, as the remote site asks that I don't use the private IP. This would save the effort to add a public IP address to my internal host.

  Thank you

  Dan

  Hello

  If for example you have an internal host 192.168.1.1 and you want NAT public IP 200.1.1.1 it address

  You can make a static NAT:

  (in, out) static 200.1.1.1 192.168.1.1

  And include the 200.1.1.1 in crypto ACL.

  Federico.

• PIX and ASA static, dynamic and RA VPN does not

  Hello

  I am facing a very interesting problem between a PIX 515 and an ASA 5510.

  The PIX is in HQ and has several dynamic VPN connections (around 130) and IPsec vpn remote works very well. I had to add a PIX to ASA L2L VPN static and it does not work as it is supposed to be. The ASA 5510, at the remote end, connects and rest for a small period of time, however, all other VPN connections stop working.

  The most interesting thing is that ASA is associated with the dynamic map and not the static map that I created (check by sh crypto ipsec his counterpart x.x.x.x). However, if I make any changes in the ACL 'ACL-Remote' it affects the tunnel between the PIX and ASA.

  Someone saw something like that?

  Here is more detailed information:

  HQ - IOS 8.0 (3) - PIX 515

  ASA 5510 - IOS 7.2 (3) - remote provider

  Several Huawei and Cisco routers dynamically connected via ADSL

  Several users remote access IPsec

  A VPN site-to site static between PIX and ASA - does not.

  Here is the config on the PIX:

  Crypto ipsec transform-set ESP-3DES-ESP-SHA-HMAC-IPSec esp-3des esp-sha-hmac

  Dyn - VPN game 100 Dynamics-card crypto transform-set ESP-3DES-ESP-SHA-HMAC-IPSec

  Crypto dynamic-map Dyn - VPN 100 the value reverse-road

  VPN - card 30 crypto card matches the ACL address / remote

  card crypto VPN-card 30 peers set 20 x. XX. XX. XX

  card crypto VPN-card 30 the transform-set ESP-3DES-ESP-SHA-HMAC-IPSec value

  VPN crypto card - 100 - isakmp dynamic Dyn - VPN ipsec

  interface card crypto VPN-card outside

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  crypto ISAKMP policy 65535

  preshared authentication

  3des encryption

  sha hash

  Group 2

  life 86400

  access list ACL-remote ext ip 10.0.0.0 allow 255.255.255.0 192.168.1.0 255.255.255.0

  Thank you.

  Marcelo Pinheiro

  The problem is that the ASA has a crypto acl defined between host and network, while the remote end has to the network.

  Make sure that the acl is reversed.

• PAT on PIX vs NAT overload on router

  Better question practice...

  It's better to perform PAT through a NAT overload on a router bastion with a static on the PIX instruction or PAT on the PIX configuration uses a global IP address?

  Other alternatives?

  Example of router *.

  Router configuration

  IP nat FirstPAT 172.16.5.100 pool 172.16.5.100 255.255.255.0

  FirstPAT IP nat source list 10 overload

  access-list 10 permit 10.10.10.0 0.255.255.255

  PIX installation

  static (inside, outside) 10.10.10.0 10.10.10.0 netmask 255.255.255.0

  Example of PIX *.

  Global (Outside) 1 172.16.5.100

  NAT (inside) 1 0 0

  Thanks in advance for all the messages!

  In my opinion, there is no real compelling reasons to go with one idea on the other. Probably, I would lean towards leaving the PIX do NAT, but I could be swayed. The reason is that the PIX has essentially already been NAT (all back on the same address). But again, either should be good.

  A suggestion however if you went with overloading NAT on the router would be to do it with a map of the route as opposed to the example of access list you have. Something like this:

  IP nat FirstPAT 172.16.5.100 pool 172.16.5.100 255.255.255.0

  IP nat source map route nat FirstPAT overload

  route nat allowed 10 map

  access-list 10 permit 10.10.10.0 0.255.255.255

  This creates a NAT entry in the NAT table on the router.

  Good luck.

  Scott

• VPN between a PIX and a VPN 3000

  I'm trying to set up a VPN between PIX and a VPN 3000. All configurations are complete, but the tunnel has not been established. On the PIX, to 'see the crypto engine' and ' show isakmp his ' orders, I do not see the tunnel. Of "show ipsec his ' command, I can see the mistakes"#send"continues to increase when I try to connect to the remote network. Here is the copy - paste command:

  Tag crypto map: myvpnmap, local addr. 10.70.24.2

  local ident (addr, mask, prot, port): (10.70.24.128/255.255.255.128/0/0)

  Remote ident (addr, mask, prot, port): (10.96.0.0/255.224.0.0/0/0)

  current_peer: 10.70.16.5:0

  LICENCE, flags is {origin_is_acl},

  #pkts program: encrypt 0, #pkts: 0, #pkts 0 digest

  #pkts decaps: 0, #pkts decrypt: 0, #pkts check 0

  compressed #pkts: 0, unzipped #pkts: 0

  #pkts uncompressed: 0, #pkts compr. has failed: 0, #pkts decompress failed:

  #send 12, #recv errors 0

  local crypto endpt. : 10.70.24.2, remote Start crypto. : 10.70.16.5

  Path mtu 1500, fresh ipsec generals 0, media, mtu 1500

  current outbound SPI: 0

  SAS of the esp on arrival:

  the arrival ah sas:

  SAS of the CFP on arrival:

  outgoing esp sas:

  outgoing ah sas:

  outgoing CFP sas:

  Obviously, the PIX identifies protected traffic but failed to establish the tunnel. I was wondering what could be the reason for these kind of mistakes? That means them growing '#send errors?

  Thank you very much!

  Sending error mean simply the PIX is grateful to encrypt this traffic, but there is no built tunnel and so it must drop the package.

  you will need to look at why the tunnel is not under construction however, "sending error" are just a byproduct of some other configuration issue. On the PIX, it looks like you would have something like:

  Crypto ip 10.70.24.128 access list allow 255.255.255.128 10.96.0.0 255.224.0.0

  On the 3000 under the L2L section and the Local and remote network, you need the exact opposite of the latter, then it would be:

  / Local network mask = 10.96.0.0/0.31.255.255

  / Remote network mask = 10.70.24.128/0.0.0.127

  If you have something else the tunnel will fail to come. Otherwise, we see that the Cryptography debugs the PIX and the trunk of the 3000 when the tunnel is built.

• Installation of site to site VPN IPSec using PIX and ASA

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  I am a site configuration to site IPSec VPN using a PIX515E to site A and ASA5520 to Site B.

  I have attached the lab diagram. Consider PIX and ASA are in default configuration, which means that nothing is configured on both devices.

  According to the scheme

  ASA5520

  External interface is the level of security 11.11.10.1/248 0

  The inside interface is 172.16.9.2/24 security level 100

  Default route is 0.0.0.0 0.0.0.0 11.11.10.2 1

  PIX515E

  External interface is the level of security 123.123.10.2/248 0

  The inside interface is 172.16.10.1/24 security level 100

  Default route is 0.0.0.0 0.0.0.0 123.123.10.1 1

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 à 5.4pt 0 à 5.4pt ; mso-para-margin : 0 ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  Could someone tell me how to set up this configuration? I tried but didn't workout. Here is the IKE protocol I have used.

  IKE information:

  IKE Encrytion OF

  MD5 authentication method

  Diffie Helman Group 2

  Failure to life

  IPSEC information:

  IPsec encryption OF

  MD5 authentication method

  Failure to life

  Please enter the following command

  on asa

  Sysopt connection permit VPN

  on pix not sure of the syntax, I think it is

  Permitted connection ipsec sysopt

  What we are trying to do here is basically allowing vpn opening ports

  Alternatively you can open udp 500 and esp (or port ip 50) out to in on the two firewalls

• PIX and non - IP traffic

  I need to install a PIX 501 in a network. The internal interface is connected to my local network and that the external interface is connected to e0 interface of the router.

  The LAN have LLC,(2) and IP traffic. Is possible to LLC,(2) traffic through the firewall without tunnel? Can I connected another interface on the router in the local network only to traffic ll2?

  Thank you

  The PIX only manages the IP traffic, so unless tyou can encapsulate your traffic IP LLC, the PIX won't touch it. I guess you can bypass the PIX and connect a LLC,(2) interface that is only on the router in your home network, depends on how secure you want to be. Make sure that you do not configure an IP address on the router interface, otherwise you will run the risk of someone circumvent security of PIX.

• PIX and SSH - access to PIX via SSH

  Need help with PIX and SSH

  Objective: Connect to PIX via SSH from the 10.1.1.50 IP address behind inside the interface on the PIX using local aaa on PIX.

  Current settings:

  hostname pix1

  example.com domain name

  CA generates the key rsa 1024

  example username password abc123 privileges 15

  include authentication AAA ssh inside 10.1.1.50 255.255.255.255 local

  SSH 10.1.1.50 255.255.255.255 inside

  Thanks for any help!

  Try this:

  AAA-server local LOCAL Protocol

  the ssh LOCAL console AAA authentication

• client ipSec VPN and NAT on the router Cisco = FAIL

  I have a Cisco 3825 router that I have set up for a Cisco VPN ipSec client.  The same router is NAT.

  ipSec logs, but can not reach the internal network unless NAT is disabled on the inside interface.  But I need both at the same time.

  Suggestions?

  crypto ISAKMP policy 3

  BA 3des

  preshared authentication

  Group 2

  !

  ISAKMP crypto client configuration group myclient

  key password!

  DNS 1.1.1.1

  Domain name

  pool myVPN

  ACL 111

  !

  !

  Crypto ipsec transform-set esp-3des esp-md5-hmac RIGHT

  !

  Crypto-map dynamic dynmap 10

  Set transform-set RIGHT

  market arriere-route

  !

  !
  list of card crypto clientmap client VPN - AAA authentication
  card crypto clientmap AAA - VPN isakmp authorization list
  client configuration address map clientmap crypto answer
  10 ipsec-isakmp crypto map clientmap Dynamics dynmap
  !

  interface Loopback0
  IP 10.88.0.1 255.255.255.0
  !
  interface GigabitEthernet0/0
  / / DESC it's external interface

  IP 192.168.168.5 255.255.255.0
  NAT outside IP
  IP virtual-reassembly
  automatic duplex
  automatic speed
  media type rj45
  clientmap card crypto
  !
  interface GigabitEthernet0/1

  / / DESC it comes from inside interface
  10.0.1.10 IP address 255.255.255.0
  IP nat inside<=================ipSec client="" connects,="" but="" cannot="" reach="" interior="" network="" unless="" this="" is="">
  IP virtual-reassembly
  the route cache same-interface IP
  automatic duplex
  automatic speed
  media type rj45

  !

  IP local pool myVPN 10.88.0.2 10.88.0.10

  p route 0.0.0.0 0.0.0.0 192.168.168.1
  IP route 10.0.0.0 255.255.0.0 10.0.1.4
  !

  IP nat inside source list 1 interface GigabitEthernet0/0 overload
  !
  access-list 1 permit 10.0.0.0 0.0.255.255
  access-list 111 allow ip 10.0.0.0 0.0.255.255 10.88.0.0 0.0.0.255
  access-list 111 allow ip 10.88.0.0 0.0.0.255 10.0.0.0 0.0.255.255

  Hello

  I think that you need to configure the ACL default PAT so there first statemts 'decline' for traffic that is NOT supposed to be coordinated between the local network and VPN pool

  For example, to do this kind of configuration, ACL and NAT

  Note access-list 100 NAT0 customer VPN
  

  access-list 100 deny ip 10.0.1.0 0.0.0.255 10.88.0.0 0.0.0.255
  

  Note access-list 100 default PAT for Internet traffic
  

  access-list 100 permit ip 10.0.1.0 0.0.0.255 ay

  overload of IP nat inside source list 100 interface GigabitEthernet0/0

  
  EDIT: seem to actually you could have more than 10 networks behind the router

  Then you could modify the ACL on this

  Note access-list 100 NAT0 customer VPN
  

  access-list 100 deny ip 10.0.1.0 0.0.255.255 10.88.0.0 0.0.0.255
  

  Note access-list 100 default PAT for Internet traffic
  

  access-list 100 permit ip 10.0.1.0 0.0.255.255 ay

  Don't forget to mark the answers correct/replys and/or useful answers to rate

  -Jouni

• Version 7.0 of the PIX and ASA 5500

  Hi all

  Is ASA 5500 series identical a PIX 515 or 525 or 535 with version 7.0... I still see some areas where it confused between version 7.0 of the PIX and ASA 5500 series... If not, what are the benefits of ASA 5500 on the PIX 7.0?

  ASA is not the same as PIX, ASA is different hardware architecture. Although both can run the same code. One of the benefits of the SAA is that you can have an IPS module in it to make the prevention of intrusions.

  Search for comprarison on CCO.