Policy NAT for VPN L2L

Similar Questions

• Making the NAT for VPN through L2L tunnel clients

  Hi.I has the following situation in my network. We need for users who log on our site with the VPN clients to connect to another site via a tunnel L2L. The problem is that I need NAT addresses from the pool of VPN client in another beach before going on the L2L tunnel because on the other side, we have duplication of networks.

  I tried to do NAT with little success as follows:

  ACL for pool NAT of VPN:

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.0.0 255.255.255.0

  Extended list ip 192.168.253.0 access TEST allow 255.255.255.0 192.168.5.0 255.255.255.0

  NAT:

  Global 172.20.105.1 - 172.20.105.254 15 (outdoor)

  NAT (inside) 15 TEST access-list

  CRYPTO ACL:

  allowed ro access list extended LAN ip 255.255.0.0 192.168.0.0 255.255.255.0

  allowed ro access list extended LAN ip 255.255.0.0 192.168.5.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.0.0 255.255.255.0

  IP 172.20.105.0 RO allow extended access list 255.255.255.0 192.168.5.0 255.255.255.0

  permit same-security-traffic intra-interface

  Am I missing something here? Something like this is possible at all?

  Thanks in advance for any help.

  We use the ASA 5510 with software version 8.0 (3) 6.

  You need nat to the outside, not the inside.

  NAT (outside) 15 TEST access-list

• Policy nat for L2L and external access

  Hello

  I'm running into an interesting question with a 506th PIX 6.3 (4)

  I created a VPN with our central location and implemented a policy nat on the 506th NAT their local 192.168.1.0/24 IPs to 10.200.25.0/24. This NATing works very well except for servers that also provide a static external IP address. I made a few captures of packets and traffic is crossing the VPN as expected and what actually at the remote end, but the answers are nat would be on the 'outside' ip of the host instead of the NAT. political I can ping other hosts on the remote network very well from the central location, not just those who have a static external IP address.

  Example:

  10.10.7.1 is my central site and try to ping a server with an IP address of 10.200.25.11 through the VPN. The traffic leaves the site central, is encrypted and delivered the firewall remotely. The firewall remotely translated 10.200.25.11-> 192.168.1.11 (the REAL Server IP) and delivers the package and the server responds, but answers are nat would be its public ip address of 75.X.X.X instead of 10.200.25.11.

  Any thoughs on how I can work around this problem?

  Here are the relevant config:

  permit for line of policy-nat access-list 1 ip 192.168.1.0 255.255.255.0 10.1.1.0 255.255.255.0

  allowed for access policy-nat-list line 2 ip 192.168.1.0 255.255.255.0 10.1.2.0 255.255.255.0

  allowed for line of policy-nat to access list 3 ip 192.168.1.0 255.255.255.0 10.10.7.0 255.255.255.0

  list of access vpn-sheep allowed ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

  list of access vpn-sheep allowed ip 192.168.1.0 255.255.255.0 172.16.100.0 255.255.255.0

  list of access vpn-sheep allowed ip 192.168.1.0 255.255.255.0 10.100.11.0 255.255.255.0

  NAT (inside) 0-list of access vpn-sheep

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  Global 1 interface (outside)

  public static 75.x.x.x (indoor, outdoor) 192.168.1.11 netmask 255.255.255.255 0 0

  public static 10.200.25.0 (inside, outside) - list of access policy-nat 0 0

  Try to rearrange your static rules:

  Do the static strategy, the first to be read by the pix

  public static 10.200.25.0 (inside, outside) - list of access policy-nat 0 0

  public static 75.x.x.x (indoor, outdoor) 192.168.1.11 netmask 255.255.255.255 0 0

  See how it goes

• NATting for VPN traffic only

  I have a client with an ASA 5505 who has several networks, he tries to communicate via a VPN tunnel with a desktop remotely. One of the networks does not work because it is also used on the other side of the tunnel management interface, and none of both sides seem ready to re - IP their interior space.

  Their proposed solution is to NAT the contradictory network on this side to a different subnet firewall before passing through the tunnel. How to implement a NAT which only uses the VPN tunnel while the rest of the traffic that comes through this device of the United-NATted Nations?

  The network in question is 192.168.0.0/24. Their target you want the NAT is 172.16.0.0/24. Config of the SAA is attached.

  Hello

  Basically, the political dynamic configuration PAT should work to connect VPN L2L because the PAT political dynamics is processed before PAT/NAT dynamic configurations.

  Only NAT configurations that can replace this dynamic NAT of the policy are

  • NAT0 / exempt NAT configuration
  • Strategy static NAT/PAT
  • Public static NAT/PAT

  And because we have determined that the only problem is with the network 192.168.0.0/24 and since there is no static configuration NAT/PAT or static policy NAT/PAT, then PAT political dynamics should be applied. Unless some configurations NAT0 continues to cause problems.

  The best way to determine what rules are hit for specific traffic is to use the command "packet - trace" on the SAA

  Packet-trace entry inside tcp 192.168.0.100 12345 10.1.7.100 80

  For example to simulate an HTTP connection at random on the remote site

  This should tell us for example

  • Where the package would be sent
  • He would pass the ACL interface
  • What NAT would be applied
  • It would correspond to any configuration VPN L2L
  • and many others

  Then can you take a sample output from the command mentioned twice and copy/paste the second result here. I ask get exit twice because that where the actual VPN L2L negotiations would go through the first time that this command would only raise the L2L VPN while the second command could show already all the info of what actually passed to the package simulated.

  In addition, judging by the NAT format you chose (political dynamics PAT), I assume that only your site connects to the remote site? Given that the political dynamics PAT (or dynamic PAT) normal does not allow creating a two-way connection. Connections can be opened that from your site to the remote site (naturally return traffic through automatically because existing connections and translations)

  -Jouni

• Packet-trace for vpn l2l

  If anyone can help with control of packet - trace to migrate to l2l ipsec vpn

  on ASA (one)

  ciscoasa # packet - trace entry outside tcp 10.10.1.2 12345 192.168.1.2 80

  ASA (one)

  Ip address inside - 192.168.1.2

  Destination port 80

  ASA (b)

  Inside - 10.10.1.2 ip address

  Port source 12345

  Hello

  So if your host 'inside' is 192.168.1.2 and the 'outside' host is 10.10.1.2 then you could just what follows

  Packet-trace entry inside tcp 192.168.1.2 12345 10.10.1.2 80

  If the goal is just to test the VPN negotiation then the ports are not really important, but naturally tested traffic with "packet - tracer" must be authorized by your interface "inside" ACL.  The essential is that the source address and destination match the VPN L2L (Crypto ACL) configurations

  Generally you would use NAT0 for these networks the and remote so NAT should not be a problem to test from that direction. I suppose there might be rare situations where using the command in this sense is not possible

  -Jouni

• Disable the NAT for VPN site-to-site

  Hello world

  I work in a company, and we had to make a VPN site-to site.

  Everything works fine, except that the packages sent to my site are translated, in other words: the firewall on the other site (site_B) see only the IP address of my firewall (Site_A).

  I tried to solve the problem, but without success, I think that natives of VPN packets is the problem.

  Here is my current config running:

  ASA Version 8.3(2)
  !
  hostname ciscoasa
  enable password 9U./y4ITpJEJ8f.V encrypted
  passwd 2KFQnbNIdI.2KYOU encrypted
  names
  !
  interface Vlan1
  nameif inside
  security-level 100
  ip address 192.168.67.254 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  ip address 41.220.X.Y 255.255.255.252 (External WAN public IP Address)
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  ftp mode passive
  clock timezone CET 1
  object network obj_any
  subnet 0.0.0.0 0.0.0.0
  object network 41.220.X1.Y1
  host 41.220.X1.Y1
  
  object network NETWORK_OBJ_192.168.67.0_24
  subnet 192.168.67.0 255.255.255.0
  object network NETWORK_OBJ_172.19.32.0_19
  subnet 172.19.32.0 255.255.224.0
  object network 194.2.176.18
  host 194.2.XX.YY (External IP address public of the other site (Site_B))
  description 194.2.XX.YY
  access-list inside_access_in extended permit ip any any log warnings
  access-list inside_access_in extended permit ip object NETWORK_OBJ_172.19.32.0_19 object NETWORK_OBJ_192.168.67.0_24 log debugging
  access-list inside_access_in extended permit ip object 194.2.176.18 any log debugging
  access-list inside_access_in extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list outside_1_cryptomap extended permit ip 192.168.67.0 255.255.255.0 172.19.32.0 255.255.224.0 log debugging
  access-list outside_1_cryptomap extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list 1111 standard permit 172.19.32.0 255.255.224.0
  access-list 1111 standard permit 192.168.67.0 255.255.255.0
  access-list outside_1_cryptomap_1 extended permit ip 172.19.32.0 255.255.224.0 any log debugging
  access-list outside_1_cryptomap_1 extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list outside_1_cryptomap_2 extended permit ip 192.168.67.0 255.255.255.0 172.19.32.0 255.255.224.0 log debugging
  access-list outside_1_cryptomap_2 extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list outside_access_in extended permit ip any any log warnings
  access-list outside_access_in extended permit ip object 194.2.XX.YY any log debugging
  access-list outside_access_in extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list nonat extended permit ip 192.168.67.0 255.255.255.0 176.19.32.0 255.255.224.0
  access-list nonat extended permit ip 192.168.67.0 255.255.255.0 172.19.32.0 255.255.224.0
  pager lines 24
  logging enable
  logging monitor informational
  logging asdm warnings
  mtu inside 1500
  mtu outside 1500
  icmp unreachable rate-limit 1 burst-size 1
  icmp permit any inside
  icmp permit any outside
  no asdm history enable
  arp timeout 14400
  nat (inside,outside) source dynamic any interface
  nat (inside,outside) source static NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 destination static NETWORK_OBJ_172.19.32.0_19 NETWORK_OBJ_172.19.32.0_19
  access-group inside_access_in in interface inside
  access-group outside_access_in in interface outside
  route outside 0.0.0.0 0.0.0.0 41.220.X.Y 1
  timeout xlate 3:00:00
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-record DfltAccessPolicy
  aaa authentication ssh console LOCAL
  aaa authentication telnet console LOCAL
  http server enable
  http 192.168.67.0 255.255.255.0 inside
  http 0.0.0.0 0.0.0.0 outside
  no snmp-server location
  no snmp-server contact
  snmp-server enable traps snmp authentication linkup linkdown coldstart
  crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
  crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
  crypto ipsec security-association lifetime seconds 28800
  crypto ipsec security-association lifetime kilobytes 4608000
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-DES-MD5
  crypto map outside_map 1 match address outside_1_cryptomap_2
  crypto map outside_map 1 set peer 194.2.XX.YY
  crypto map outside_map 1 set transform-set ESP-DES-MD5
  crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  crypto map outside_map interface outside
  crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  crypto map inside_map interface inside
  crypto isakmp enable inside
  crypto isakmp enable outside
  crypto isakmp policy 10
  authentication pre-share
  encryption des
  hash md5
  group 2
  lifetime 86400
  telnet 192.168.67.200 255.255.255.255 inside
  telnet timeout 5
  ssh 0.0.0.0 0.0.0.0 outside
  ssh timeout 30
  console timeout 0
  dhcpd auto_config outside
  !
  threat-detection basic-threat
  threat-detection statistics access-list
  no threat-detection statistics tcp-intercept
  webvpn
  username bel_md password HSiYQZRzgeT8u.ml encrypted privilege 15
  username nebia_said password qQ6OoFJ5IJa6sgLi encrypted privilege 15
  tunnel-group 194.2.XX.YY type ipsec-l2l
  tunnel-group 194.2.XX.YY ipsec-attributes
  pre-shared-key *****
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  policy-map type inspect dns preset_dns_map
  parameters
  message-length maximum client auto
  message-length maximum 512
  policy-map global_policy
  class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect ipsec-pass-thru
  !
  service-policy global_policy global
  prompt hostname context
  Cryptochecksum:0398876429c949a766f7de4fb3e2037e
  : end
  

  If you need any other information or explanation, just ask me.

  My firewall model: ASA 5505

  Thank you for the help.

  Hey Houari,.

  I suspect something with the order of your NATing statement which is:

  NAT (inside, outside) static static source NETWORK_OBJ_172.19.32.0_19 destination NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_172.19.32.0_19

  Can you please have this change applied to the ASA:

  No source (indoor, outdoor) nat static static NETWORK_OBJ_172.19.32.0_19 destination NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_172.19.32.0_19

  NAT (inside, outside) 1 static source NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 static destination NETWORK_OBJ_172.19.32.0_19 NETWORK_OBJ_172.19.32.0_19

  Try and let me know how it goes.

  If she did not help, please put the output form a package tracer will shape your internal network to the remote VPN subnet with the release of «see the nat detail»

  HTH,

  Mo.

• Rule of NAT for vpn access... ?

  Hey, putting in place the vpn ssl via the client Anyconnect on a new ASA 5510, ASA ASDM 6.4.5 8.4.2.

  I am able to 'connect' through the anyconnect client, & I am assigned an ip address from the pool of vpn that I created, but I can't ping or you connect to internal servers.

  I think that I have configured the split tunneling ok following the guide below, I can browse the web nice & quickly while connected to the vpn but just can't find anything whatsoever on the internal network.

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080975e83.shtml

  I suspect her stockings for a nat rule, but I am a bit stuck if it should be a rule of nat object network or if it must be dynamic/static & if its between the external interface or external ip & network inside or the VPN (I created the pool on a different subnet), or a 'Beach' (but then I am getting overlapping ip errors when I try to create a rule for a range of IP addresses.

  Any advice appreciated,

  Hi Eunson,

  After have connected you to the ASA that clients receive an IP address, let's say 192.168.10.0/24 pool, the network behind the ASA is 192.168.20.0/24.

  On the SAA, you would need an NAT exemption for 192.168.20.0 to 192.168.10.0

  Create two groups of objects, for pool VPN and your itnernal LAN.

  object-group network object - 192.168.20.0

  object-network 192.168.20.0 255.255.255.0

  object-group network object - 192.168.10.0

  object-network 192.168.10.0 255.255.255.0

  NAT (inside, outside) 1 source static object - 192.168.20.0 object - 192.168.20.0 destination static object - 192.168.10.0 object - 192.168.10.0 non-proxy-arp-search to itinerary

  At the inside = interface behind which is your LOCAL lan

  Outside = the interface on which the Clients connect.

  If you can't still access then you can take the shot on the inside interface,

  create and acl

  access-list allowed test123 ip host x.x.x.x y.y.y.y host

  access-list allowed test123 ip host host x.x.x.x y.y.y.y

  interface test123 captures inside test123 access list

  view Cape test123

  It will show if the packages are extinguished inside the interface and if we see that the answers or not. If we have all the answers, this means that there might be a routing on the internal LAN problem as devices know may not be not to carry the traffic of 192.168.10.0 return to the ASA inside the interface.

  Or maybe it's that there is a firewall drop packets on your internal LAN.

  HTH

• Issue of NAT for VPN

  If I have a LAN or 10.1.1.0/24 and I want NAT all of the hosts in 192.168.1.0/24.  I really don't want to create the object for each unique host network, because it's just for a lot.  I just wanted to confirm by creating two objects then natting them must configure a NAT right one?

  network object obj - 10.1.1.0

  10.1.1.0 subnet 255.255.255.0

  !

  network object obj - 192.168.1.0

  subnet 192.168.1.0 255.255.255.0

  !

  NAT (inside, outside) source static obj - 10.1.1.0 obj - 192.168.1.0 statick "remotely" destination "at a distance".

  Now when the remote network need access to network 10.1.1.0/24 hosts they should just be able to access to?

  10.1.1.1 will map to 192.168.1.1

  10.1.1.2 will map to 192.168.1.2

  10.1.1.3 will map to 192.168.1.3

  and so on...?

  In addition,

  A test on my ASA home

  Configuration

  the object of the LAN network

  10.0.0.0 subnet 255.255.255.0

  network of the REMOTE object

  subnet 10.0.1.0 255.255.255.0

  network of the LAN - NAT object

  10.0.100.0 subnet 255.255.255.0

  LAN LAN destination - static NAT NAT (LAN, WAN) static source REMOTE

  LAN remotely

  ASA (config) # packet - trace tcp 10.0.0.10 LAN entry 1025 10.0.1.1 80

  Phase: 3

  Type: NAT

  Subtype:

  Result: ALLOW

  Config:

  LAN LAN destination - static NAT NAT (LAN, WAN) static source REMOTE

  Additional information:

  Definition of static 10.0.0.10/1025 to 10.0.100.10/1025

  REMOTE CONTROL FOR LAN

  ASA (config) # packet - trace entry WAN tcp 10.0.1.100 1025 10.0.100.10 80

  Phase: 1

  Type: UN - NAT

  Subtype: static

  Result: ALLOW

  Config:

  LAN LAN destination - static NAT NAT (LAN, WAN) static source REMOTE

  Additional information:

  NAT divert on the LAN of the output interface

  Untranslate 10.0.100.10/80 to 10.0.0.10/80

  -Jouni

• MS CA for VPN L2L ASA

  What type of certifcates I should issueing bee in my ASA.

  Now I'm issueing IPSEC (offline) and I don't know if it's the right kind.

  I have ICP work for mobile users. simply not L2L

  Yes,

  Which can cause failure.

  Put command

  "ignore-ipsec-keyusage" under the CompanyTrustPoint

  That should solve.

• ASA 8.4. (1) VPN L2L can only be established through default gateway

  Hi all!

  We have an ASA 5510, with two internet connections. A destined for VPN l2l and the other to access inet users in general.

  On asa 8.04, I configured the encryption on inteface "VPNAccess" card and a static route on the remote peer L2L with access internet VPN, the default rotue pointed the router General inet.

  We bought a new firewall with 8.4.1 and now asa only tries to open the remote if peer traffic is on the default gateway.

  It does not take into account routes more specific (I mean longer masks) and always tries to use the gateway by default, but only for VPN, if I do a trace to that peer route, it uses the routing table correctly.

  Any advice?

  Thank you!

  Well well, (any, any) certainly does not help.

  You need to be more specific, otherwise, even once, as suggested earlier, he does not know which interface to use because you don't have specify it.

  In addition, you must also be precise with the source network and destination. Otherwise, the firewall will not know which interface the subnet should be connected to.

  More precise best for NAT statement.

  NAT (, PublicTESAVPNBackup) source static static destination

• RA VPN VPN L2L via NAT strategy

  Scenario: we have remote access VPN users who need to access a VPN L2L by ASA even outside the interface. This particular VPN L2L is a partner that requires us to NAT (192.168.x.x) addresses to another private address (172.20.x.x). We also access VPN L2L to internal hosts. NATing to the partner is accomplished through a NAT policy.

  Our remote VPN users cannot access the L2L VPN. It seems that the host address VPN (assigned through RADIUS) is not in THAT NAT would not, even if it is in the range object.

  "Group" is configured and works for the other VPN.

  NO - NAT ACL does not seem to be involved (which it shouldn't), as the address of the internal host (192.168.60.x) is not NAT to be the public address.

  Internal hosts that can access the VPN tunnel very well.

  Here are the relevant config:

  permit same-security-traffic intra-interface

  the OURHosts object-group network

  host 192.168.1.x network-object

  host 192.168.2.x network-object

  object-network 192.168.60.0 255.255.255.0

  the PartnerHosts object-group network

  network-host 10.2.32.a object

  network-host 10.2.32.b object

  network-host 10.2.32.c object

  access-list extended NAT2 allowed ip object-group OURHosts-group of objects PartnerHosts

  Global (OUTSIDE) 2 172.20.x.x

  NAT (INSIDE) 2-list of access NAT2

  The syslog error we receive:

  % ASA-4-402117: IPSEC: received a package not IPSec (Protocol = ICMP) 10.2.32.a to 192.168.60.x

  Yes. According to the config that you posted, there is no command currently in no place in vpn nat clients the RA to the hairpin above the tunnel.

  The inside of our customers work due to "nat (INSIDE) 2 NAT2 access-list. But because your VPN RA customers coming from "OUTSIDE", this statement by nat would have no effect on them.

• 8.2 ASA vpn filter for connections l2l

  I have a vpn-filter set to my police L2L. The remote site uses a Cisco 1811 router and the main hub is a Cisco 5580. I already have an acl of vpn-filter in place on an existing L2L connection which works fine. The only question is, when I make changes to the ACLs for add/remove access, I have to reload the whole of the tunnel until the changes take place.

  My question is, are at - it a command to reload the access control without destroying the tunnel?

  Hi Jeffrey,.

  Design whenever there are changes in the attributes of Group Policy (including the vpn-filter, dns ip of victories or vpn-Protocol etc.), you need to reset the respective tunnel while phase 2 is negotiating with the newly added policy. The command to clear a specific tunnel is: -.

  his clear crypto ipsec peer

  For more details on the command, please see the link below

  http://www.Cisco.com/en/us/docs/security/ASA/asa80/command/reference/C3.html#wp2133652

  So, to answer your query wasn't there command is not to reset the access control. There had been such a command you would still back the tunnel to trigger negotiations ipsec with the new group policy settings.

  HTH...

  Concerning
  Mohit

• Can the NAT of ASA configuration for vpn local pool

  We have a group of tunnel remote ipsec, clients address pool use 172.18.33.0/24 which setup from command "ip local pool. The remote cliens must use full ipsec tunnel.

  Because of IP overlap or route number, we would like to NAT this local basin of 172.18.33.0 to 192.168.3.0 subnet when vpn users access certain servers or subnet via external interface of the ASA.  I have nat mapping address command from an interface to another interface of Armi. The pool local vpn is not behind any physical interface of the ASA. My question is can ASA policy NAT configuration for vpn local pool.  If so, how to set up this NAT.

  Thank you

  Haiying

  Elijah,

  NAT_VPNClients ip 172.18.33.0 access list allow 255.255.255.0 10.1.1.0 255.255.255.0

  public static 192.168.33.0 (external, outside) - NAT_VPNClients access list

  The above configuration will be NAT 172.18.33.0/24 to 192.168.33.0/24 when you go to 10.1.1.0/24 (assuming that 10.1.1.0/24 is your subnet of servers).

  To allow the ASA to redirect rewritten traffic the same interface in which he receive, you must also order:

  permit same-security-traffic intra-interface

  Federico.

• Do you need a VPN L2L NAT

  Hi all

  I need to create a VPN L2L tunnel between us and another local company. We use a 3845 router and the other carrier uses a 3745 router. I created a lot of VPN tunnels in the past using NAT. In this case, I don't have to. is it possible for a tunnel VPN work with the same configuration without using NAT. My router and the device being connected to all have a public IP address on the same subnet.

  Thank you

  Stevan

  Hello

  Yes, you can create L2L without having to use NAT.

  See the examples of configuration (under VPN Site to Site with PIX/IOS):

  http://www.Cisco.com/en/us/partner/products/HW/vpndevc/ps2030/prod_configuration_examples_list.html

  Before that, you have probably more experience configuration tunnel as shown in the url below:

  http://www.Cisco.com/en/us/Partner/Tech/tk583/TK372/technologies_configuration_example09186a00800949ef.shtml

  Rgds,

  AK

• I need VPN gateway to gateway with NAT for several subnets, RV082

  I have a pair of RV082 routers and I would like to configure a gateway to gateway VPN tunnel, as described in a book, "How to configure a VPN tunnel that routes all traffic to the remote gateway," (name of file Small_business_router_tunnel_Branch_to_Main.doc).  I followed this recipe book and found that my while the main office has internet connectivity, the branch subnet is not an internet connection.

  Routing behaves as advertised, where all traffic goes to the seat.  However, the 192.168.1.0 subnet in the branch receives no internet connectivity.  I read in other posts that the main router will provide only NAT for the local subnet, not the Management Office subnet.  Is it possible to configure the RV082 router to provide NAT for all subnets?

  If this is not the case, what product Cisco will provide connectivity VPN Tunnel as well as the NAT for all subnets?  The RV082 can be used as part of the final solution or are my RV082s a wasted expense?

  Here is the configuration that I had put in place, (real IP and IKE keys are false).

  Bridge to bridge

  Remote Head Office

  Add a new Tunnel

  No de tunnel                  1                                               2

  Name of the tunnel:, n1 n1-2122012_n2-1282012-2122012_n2-1282012

  Interface: WAN1 WAN1

  Enable :                   yes                                             yes

  --------------------------------------------------------------------------------

  Configuration of local groups

  Type of local security gateway: IP only IP only

  IP address: 10.10.10.123 10.10.10.50

  Local security group type: subnet subnet

  IP address: 192.168.1.0 0.0.0.0

  Subnet mask: 255.255.255.0 0.0.0.0

  --------------------------------------------------------------------------------

  Configuration of the remote control groups

  Remote security gateway type: IP only IP only

  IP address: 65.182.226.50 67.22.242.123

  Security remote control unit Type: subnet subnet

  IP address: 0.0.0.0 192.168.1.0

  Subnet mask: 0.0.0.0 255.255.255.0

  --------------------------------------------------------------------------------

  IPSec configuration

  Input mode: IKE with preshared key IKE with preshared key

  Group of the phase 1 of DH: Group 5 - 1536 bit group 5 - 1536 bit

  Encryption of the phase 1: of THE

  The phase 1 authentication: MD5 MD5

  Step 1 time in HIS life: 2800 2800 seconds

  Perfect Forward Secrecy: Yes Yes

  Group of the phase 2 DH: Group 5 - 1536 bit group 5 - 1536 bit

  Encryption of the phase 2: of THE

  Phase 2 of authentication: MD5 MD5

  Time of the phase 2 of HIS life: 3600 seconds 3600 seconds

  Preshared key: MyKey MYKey

  Minimum complexity of pre-shared key: Enable Yes Enable

  --------------------------------------------------------------------------------

  If you are running 4.x firmware on your RV082, you must add an additional Allow access rule for the Branch Office subnet (considered one of the multiple subnets in the main office) may have access to the internet. Note the firmware version has more details about it.

  http://www.Cisco.com/en/us/docs/routers/CSBR/rv0xx/release/rv0xx_rn_v4-1-1-01.PDF