Static NAT enable VPN site-to-site.

Similar Questions

• Disable the NAT for VPN site-to-site

  Hello world

  I work in a company, and we had to make a VPN site-to site.

  Everything works fine, except that the packages sent to my site are translated, in other words: the firewall on the other site (site_B) see only the IP address of my firewall (Site_A).

  I tried to solve the problem, but without success, I think that natives of VPN packets is the problem.

  Here is my current config running:

  ASA Version 8.3(2)
  !
  hostname ciscoasa
  enable password 9U./y4ITpJEJ8f.V encrypted
  passwd 2KFQnbNIdI.2KYOU encrypted
  names
  !
  interface Vlan1
  nameif inside
  security-level 100
  ip address 192.168.67.254 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  ip address 41.220.X.Y 255.255.255.252 (External WAN public IP Address)
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  !
  interface Ethernet0/7
  !
  ftp mode passive
  clock timezone CET 1
  object network obj_any
  subnet 0.0.0.0 0.0.0.0
  object network 41.220.X1.Y1
  host 41.220.X1.Y1
  
  object network NETWORK_OBJ_192.168.67.0_24
  subnet 192.168.67.0 255.255.255.0
  object network NETWORK_OBJ_172.19.32.0_19
  subnet 172.19.32.0 255.255.224.0
  object network 194.2.176.18
  host 194.2.XX.YY (External IP address public of the other site (Site_B))
  description 194.2.XX.YY
  access-list inside_access_in extended permit ip any any log warnings
  access-list inside_access_in extended permit ip object NETWORK_OBJ_172.19.32.0_19 object NETWORK_OBJ_192.168.67.0_24 log debugging
  access-list inside_access_in extended permit ip object 194.2.176.18 any log debugging
  access-list inside_access_in extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list outside_1_cryptomap extended permit ip 192.168.67.0 255.255.255.0 172.19.32.0 255.255.224.0 log debugging
  access-list outside_1_cryptomap extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list 1111 standard permit 172.19.32.0 255.255.224.0
  access-list 1111 standard permit 192.168.67.0 255.255.255.0
  access-list outside_1_cryptomap_1 extended permit ip 172.19.32.0 255.255.224.0 any log debugging
  access-list outside_1_cryptomap_1 extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list outside_1_cryptomap_2 extended permit ip 192.168.67.0 255.255.255.0 172.19.32.0 255.255.224.0 log debugging
  access-list outside_1_cryptomap_2 extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list outside_access_in extended permit ip any any log warnings
  access-list outside_access_in extended permit ip object 194.2.XX.YY any log debugging
  access-list outside_access_in extended permit ip any object NETWORK_OBJ_172.19.32.0_19 log debugging
  access-list nonat extended permit ip 192.168.67.0 255.255.255.0 176.19.32.0 255.255.224.0
  access-list nonat extended permit ip 192.168.67.0 255.255.255.0 172.19.32.0 255.255.224.0
  pager lines 24
  logging enable
  logging monitor informational
  logging asdm warnings
  mtu inside 1500
  mtu outside 1500
  icmp unreachable rate-limit 1 burst-size 1
  icmp permit any inside
  icmp permit any outside
  no asdm history enable
  arp timeout 14400
  nat (inside,outside) source dynamic any interface
  nat (inside,outside) source static NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 destination static NETWORK_OBJ_172.19.32.0_19 NETWORK_OBJ_172.19.32.0_19
  access-group inside_access_in in interface inside
  access-group outside_access_in in interface outside
  route outside 0.0.0.0 0.0.0.0 41.220.X.Y 1
  timeout xlate 3:00:00
  timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
  timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
  timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  timeout tcp-proxy-reassembly 0:01:00
  dynamic-access-policy-record DfltAccessPolicy
  aaa authentication ssh console LOCAL
  aaa authentication telnet console LOCAL
  http server enable
  http 192.168.67.0 255.255.255.0 inside
  http 0.0.0.0 0.0.0.0 outside
  no snmp-server location
  no snmp-server contact
  snmp-server enable traps snmp authentication linkup linkdown coldstart
  crypto ipsec transform-set ESP-DES-MD5 esp-des esp-md5-hmac
  crypto ipsec transform-set ESP-DES-SHA esp-des esp-sha-hmac
  crypto ipsec security-association lifetime seconds 28800
  crypto ipsec security-association lifetime kilobytes 4608000
  crypto dynamic-map SYSTEM_DEFAULT_CRYPTO_MAP 65535 set transform-set ESP-DES-MD5
  crypto map outside_map 1 match address outside_1_cryptomap_2
  crypto map outside_map 1 set peer 194.2.XX.YY
  crypto map outside_map 1 set transform-set ESP-DES-MD5
  crypto map outside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  crypto map outside_map interface outside
  crypto map inside_map 65535 ipsec-isakmp dynamic SYSTEM_DEFAULT_CRYPTO_MAP
  crypto map inside_map interface inside
  crypto isakmp enable inside
  crypto isakmp enable outside
  crypto isakmp policy 10
  authentication pre-share
  encryption des
  hash md5
  group 2
  lifetime 86400
  telnet 192.168.67.200 255.255.255.255 inside
  telnet timeout 5
  ssh 0.0.0.0 0.0.0.0 outside
  ssh timeout 30
  console timeout 0
  dhcpd auto_config outside
  !
  threat-detection basic-threat
  threat-detection statistics access-list
  no threat-detection statistics tcp-intercept
  webvpn
  username bel_md password HSiYQZRzgeT8u.ml encrypted privilege 15
  username nebia_said password qQ6OoFJ5IJa6sgLi encrypted privilege 15
  tunnel-group 194.2.XX.YY type ipsec-l2l
  tunnel-group 194.2.XX.YY ipsec-attributes
  pre-shared-key *****
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  policy-map type inspect dns preset_dns_map
  parameters
  message-length maximum client auto
  message-length maximum 512
  policy-map global_policy
  class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect rsh
  inspect rtsp
  inspect esmtp
  inspect sqlnet
  inspect skinny
  inspect sunrpc
  inspect xdmcp
  inspect sip
  inspect netbios
  inspect tftp
  inspect ip-options
  inspect icmp
  inspect ipsec-pass-thru
  !
  service-policy global_policy global
  prompt hostname context
  Cryptochecksum:0398876429c949a766f7de4fb3e2037e
  : end
  

  If you need any other information or explanation, just ask me.

  My firewall model: ASA 5505

  Thank you for the help.

  Hey Houari,.

  I suspect something with the order of your NATing statement which is:

  NAT (inside, outside) static static source NETWORK_OBJ_172.19.32.0_19 destination NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_172.19.32.0_19

  Can you please have this change applied to the ASA:

  No source (indoor, outdoor) nat static static NETWORK_OBJ_172.19.32.0_19 destination NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_172.19.32.0_19

  NAT (inside, outside) 1 static source NETWORK_OBJ_192.168.67.0_24 NETWORK_OBJ_192.168.67.0_24 static destination NETWORK_OBJ_172.19.32.0_19 NETWORK_OBJ_172.19.32.0_19

  Try and let me know how it goes.

  If she did not help, please put the output form a package tracer will shape your internal network to the remote VPN subnet with the release of «see the nat detail»

  HTH,

  Mo.

• ASA 8.4 (1) source-nat over vpn site-to-site

  I'm setting up a tunnel vpn site-to-site and require nat for the local and remote side. The remote side will be nat to

  10.2.255.128/25 on their face before they reach our network, so I have to only source-nat our servers via the tunnel to them. Should I just do the static NAT, then let the whole subnet through the acl of valuable traffic as the config below? I don't think I should use twice a nat because I'm not trying to make the destination nat on the firewall. Servers with us will 10.2.255.128/25 and I would like to preserve it through the ASA.

  network of the ServerA object

  host 10.1.0.1

  NAT 10.2.255.1 static (inside, outside)

  network of the object server b

  host 10.1.0.2

  NAT 10.2.255.2 static (inside, outside)

  the object server c network

  host 10.1.0.3

  NAT 10.2.255.3 static (inside, outside)

  the LOCAL_SUBNET object-group network

  object-network 10.2.255.0 255.255.255.128

  the REMOTE_SUBNET object-group network

  object-network 10.2.255.128 255.255.255.128

  VPN_ACL list extended access permitted ip object-group LOCAL_SUBNET-group of objects REMOTE_SUBNET

  Thank you

  Your configuration is correct, but I have a few comments.  Remember that NAT occurs before the delivery of your servers will be translated into 10.2.255.2 and 10.2.255.3 and then sent through the tunnel, so your encryption field is correct.

  Is your internet firewall as well? What your servers out of the internet?  They will be translated to 10.2.255.2 and 10.2.255.3 and who will fail in internet routing is.  If these servers access the internet through the firewall, I would recommend a configuration like this for each of your servers:

  network of the ServerA_NAT object

  Home 10.2.255.1

  NAT static ServerA ServerA_NAT destination (indoor, outdoor) static source REMOTE_SUBNET REMOTE_SUBNET

  This will use destination basic NAT for traffic VPN and NAT everything to a public IP address for the internet traffic.  Of course, if this is not your internet connection firewall can do abstraction.

• NAT and VPN site-2-Site

  Hello world.

  I have question about Site 2 Site VPN and NAT.

  HQ is connected to the partner and the co-location through site to site VPN (with two different tunnels). Co-location is connected to the HQ with the site 2 site VPN.

  HQ:
  Co-location:
  Partner:

  Basically, what I want to achieve is to do the following:

  All traffic from the combination with destination partner should switch from AC and source what IP must be changed. So it seems that the traffic originated in the DMZ HQ on the side of the partner.

  How can I achieve that?

  HW: Cisco ASA

  Hello Roger,.

  The configuration you need will be on the ASA HQ.

  First configure the ASA so that it would allow the traffic to leave through the same interface it came through:

  permit same-security-traffic intra-interface

  Then, you create a nat that an IP address of this beach (it will work if the partner does not need to go to the apartment, just camp to the partner):

  policy-based-nat1 permit ip access list

  NAT () to access list policy-based-nat1

  (Global)

  That is asuming that you already have a rule of traffic interesting (crypto ACL map) allowed your DMZ for flatsharing.

  For a more specific example, see below:

  Colocation network: 192.168.1.0/24

  Network DMZ HQ: 10.10.10.0/24

  Network partner: 172.16.10.0/24

  permit same-security-traffic intra-interface

  access list policy-based-nat1 permit ip 192.168.1.0 255.255.255.0 172.16.10.0 255.255.255.0
  

  NAT (outdoor) 100 access list policy-based-nat1

  global (outside) 100 10.10.10.253

  vpn10 10.10.10.0 ip access list allow 255.255.255.0 172.16.10.0 255.255.255.0

  10 correspondence address vpn vpn crypto card

  If the partner needs to access the apartment so (two-way access) you may not use the DMZ network as there must be a translation from one to the other and you have the same amount of addresses to be translated you have on the apartment.

  However, it would be possible if your DMZ network is greater than the apartment (like DMZ being a 16 and colo in 24) and you can isolate a subnet just for NAT.

  Hope this helps to solve the problem.

• Cannot access static nat address via vpn.

  I have an asa5510 where I

  a static nat from one interface to the other.

  I also have a VPN connection to the asa...

  On the other side of the vpn connection, I can not access this static NAT.

  192.168.170.x is the vpn network.

  Is it not possible to access the static NAT over vpn?

  the DM_INLINE_NETWORK_16 object-group network
  object-network 192.168.0.0 255.255.255.0
  object-network vxtron 255.255.255.0
  object-network dmz_zone 255.255.255.0
  object-network 192.168.170.0 255.255.255.0

  MPLS_nat0_outbound list extended access deny host ip 172.26.1.5 all

  Access extensive list ip 172.26.0.0 MPLS_nat0_outbound allow 255.255.252.0 object-group DM_INLINE_NETWORK_16

  pnat1 list extended access permit ip host 172.26.1.5 all

  static (MPLS, inside) 192.168.0.199 access list pnat1

  NAT (MPLS) 0-list of access MPLS_nat0_outbound
  NAT (MPLS) 1 172.26.0.0 255.255.252.0
  static (MPLS, inside) 172.26.1.5 MPLS_nat_static access list

  René, happy you including yourself this one! If you could, please mark the post as solved so that we know that it is not need more attention

• local host to access the vpn site to site with nat static configured

  I have two 881 routers with vpn site to site between them. I have a static nat on the router for a Web server that is accessible from the internet. I can't access the Web server through the vpn. All other traffic is fine its VPN. I think that there is a problem with the NAT. Here are the relevant configuration lines.

  IP nat inside source overload map route SDM_RMAP_1 interface FastEthernet4
  IP nat inside source static 192.168.150.2 bonnefin map route SDM_RMAP_1

  allowed SDM_RMAP_1 1 route map
  corresponds to the IP 100

  access-list 100 deny ip 192.168.150.0 0.0.0.255 192.168.123.0 0.0.0.255
  access-list 100 permit ip 192.168.150.0 0.0.0.255 any

  You should be able to access the web server with its IP private (192.168.150.2) through the VPN connection.

  If you just add the VPN and the road map, try to clear the existing translation and see if you can access it via its private of the Remote LAN VPN ip address.

• Cisco ASA VPN Site to Site WITH NAT inside

  Hello!

  I have 2 ASA 5505 related to IPSEC Tunnel VPN Site to Site.

  A 192.168.1.0/24 'remotely' inside the network and a local "192.168.200.0/24' inside the network (you can see the diagram)

  The local host have 192.168.200.254 as default gateway.

  I can't add static route to all army and I can't add static route to 192.168.200.254.

  NAT the VPN entering as 192.168.200.1 or a 192.168.200.x free to connect my host correcly?

  If my host sends packet to exit to the default gateway.

  Thank you for your support

  Best regards

  Marco

  The configuration must be applied on the SAA with the 192.168.200.0 subnet it is inside, there must be something like this:

  permit 192.168.1.0 ip access list VPN_NAT 255.255.255.0 192.168.200.0 255.255.255.0

  NAT (outside) X VPN_NAT outside access list

  Global (inside) X Y.Y.Y.Y (where the Y.Y.Y.Y) is the ip address

  If you have other traffic on the vpn through the tunnel that requires no nat, then you must add external nat exemption rules since these lines above obliges all traffic through the asa to have a nat statement.

  See if it works for you, else post your config nat here.

• VPN site-to-site between 3 dynamic ip site to ip address static site

  Hi all

  I have a scenario,

  I have a static ip address in the headquarters and I have 4 office locations of all offices of construction site have dynamic ip.

  I created a site to site vpn between HO perfect work for 1 site office

  but I create a second profile in HO ASA for site office 2 config, I have created does not work.

  I use HO ASA 5520 and branches 5505 all site offices is ADSL connection

  I enclose my config HO

  Can u sat down just how dynamic config several profile in the HO

  Thank you

  Zeus

  It's just a suggestion...

  You want to get 3 dynamic sites connected with the HO, right?

  HO:

  As the branch have dynamic ip, you must use the DefaultL2LGroup profile (the same shared key for all three BO).

  The crypto-plan should be dynamic with the right soure/destination NET configured. Exempt NAT with the same source/destination NET as well.

  BO:

  Configured as a VPN Site-2-Site normal with the HO. The IPSEC Wizard is very useful.

  To connect to HO Bo, the branch must initiate the tunnel. After that, you have 2 full functional site site VPN.

  http://www.Cisco.com/en/us/partner/products/ps6120/products_configuration_example09186a00805733df.shtml

  Welcome,

  Norbert

• VPN site to Site with NAT (PIX 7.2)

  Hi all

  I hope for more help with config PIX.  TBH I would classify myself as a newb on PIX, only dabbling in it every 6 months or so...

  I have to configure a VPN site-to site between our UK and US Office, to replace our frame relay link.  I have configured multiple VPN site to site on the before PIX, so am reasonably okay with the appearance of the config of who.  What is a new concept for me is the needs of NAT'ing between the IPSEC tunnel.

  The U.S. Agency requires us to NAT source addresses (i.e. 192.168.1.0) usable on their side address (i.e. 143.102.89.0).  The tunnel must then be set to encrypt traffic between 143.102.89.0/24 and 172.24.0.0/14.

  I added the following config and hoping to test it at the U.S. office happens online today.

  If I Ping from 192.168.1.0 to 172.24.x.x source and run a SH NAT inside, the NAT translation seems good.

  is the intellectual property inside 192.168.1.0 255.255.255.0 outside 172.24.0.0 255.252.0.0
  static translation at 143.102.89.0
  translate_hits = 4, untranslate_hits = 0

  Could someone please go through the following lines of config and comment if there is no error?

  Thank you very much

  Kevin

  / * Style definitions * / table. MsoNormalTable {mso-style-name : « Table Normal » ; mso-tstyle-rowband-taille : 0 ; mso-tstyle-colband-taille : 0 ; mso-style-noshow:yes ; mso-style-priorité : 99 ; mso-style-qformat:yes ; mso-style-parent : » « ;" mso-rembourrage-alt : 0 cm 5.4pt cm 0 5.4pt ; mso-para-margin : 0 cm ; mso-para-marge-bottom : .0001pt ; mso-pagination : widow-orphelin ; police-taille : 11.0pt ; famille de police : « Calibri », « sans-serif » ; mso-ascii-font-family : Calibri ; mso-ascii-theme-font : minor-latin ; mso-fareast-font-family : « Times New Roman » ; mso-fareast-theme-font : minor-fareast ; mso-hansi-font-family : Calibri ; mso-hansi-theme-font : minor-latin ; mso-bidi-font-family : « Times New Roman » ; mso-bidi-theme-font : minor-bidi ;}

  IP 143.102.89.0 allow Access-list ipsec - dallas extended 255.255.255.0 172.24.0.0 255.252.0.0

  policy-nat-dallas-list of allowed extensive access ip 192.168.1.0 255.255.255.0 172.24.0.0 255.252.0.0

  public static 143.102.89.0 (inside, outside) - list of access policy-nat-dallas

  Crypto ipsec transform-set esp-3des esp-md5-hmac 3desmd5set

  card crypto map dyn 40 correspondence address ipsec - dallas

  set dyn-map 40 crypto map peer 143.101.6.141

  card crypto dyn-map 40 transform-set 3desmd5set

  dyn-map interface card crypto outside

  crypto isakmp identity address

  crypto ISAKMP allow outside

  crypto ISAKMP policy 10

  preshared authentication

  3des encryption

  md5 hash

  Group 2

  life 86400

  tunnel-group 143.101.6.141 type ipsec-l2l

  IPSec-attributes tunnel-group 143.101.6.141

  pre-shared-key *.

  You can configure NAT/Global pair for the rest of the users.

  For example:

  You can use the initially configured ACL:

  policy-nat-dallas-list of allowed extensive access ip 192.168.1.0 255.255.255.0 172.24.0.0 255.252.0.0
  NAT (inside) 1 access list policy-nat-dallas

  Global 1 143.102.89.x (outside)

  The static statement that you configured previously will take precedence over the above. So the printer gets statically using a NAT to 143.102.89.10, and the rest can do another ip address 143.102.89.x PATed.

  Please note that for PAT, traffic can only be initiated from 192.168.1.0/24 LAN to 172.24.0.0/14, not the other way around.

  Hope that helps.

• VPN site to Site - NAT network internal

  Hi all

  I have a site to site VPN setup (both sites have Cisco ASA) where my internal network is 192.168.1.0/24 and internal, the other site of the network happens to have the exact same internal network. Is it possible that I can NAT my internal address to 172.18.1.0/24 and I get the job? It should then allow both sites to communicate successfully. Thank you.

  Hello

  You'll have to NAT to both ends of the VPN L2L connection. This is because even if you the other end to another network NAT it will mean that this site would have to connect to a destination address that is apparently in its own network and connections would fail.

  The format of configuration depends on your level of ASAs software

  8.2 software (and below)

  Comment by L2LVPN-POLICYNAT-access list policy NAT for VPN L2L

  permit access-list L2LVPN-POLICYNAT

  static (inside, outside) access-list L2LVPN-POLICYNAT

  Software 8.3 (and above)

  the object of the LAN network

  subnet

  network of the LAN - NAT object

  subnet

  network of the REMOTE object

  subnet

  NAT static LAN LAN destination - NAT source (indoor, outdoor) static REMOTE

  Note to use the correct networks in the statements above. The destination in the configuration network is naturally the NAT network uses the other site.

  In the same say, you can you make sure your L2L Crypto ACL VPN connections using the local NAT network as the source and the remote NAT network as the destination.

  Hope this helps

  -Jouni

• Cisco Asa vpn site-to-site with nat

  Hi all

  I need help
  I want to make a site from the site with nat vpn
  Site A = 10.0.0.0/24
  Site B = 10.1.252.0/24

  I want when site A to site B, either by ip 172.26.0.0/24

  Here is my configuration

  inside_nat_outbound to access ip 10.0.0.0 scope list allow 255.255.255.0 10.1.252.0 255.255.255.0

  tunnel-group x.x.x.x type ipsec-l2l
  tunnel-group ipsec-attributes x.x.x.x
  pre-shared-key!

  ISAKMP retry threshold 10 keepalive 2

  Crypto ipsec transform-set ESP-AES-256-SHA 256 - aes - esp esp-sha-hmac
  card crypto outside_map 2 match address inside_nat_outbound

  card crypto outside_map 2 pfs set group5
  card crypto outside_map 2 peers set x.x.x.x

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  NAT (inside) 10 inside_nat_outbound

  Global 172.26.0.1 - 172.26.0.254 10 (outside)

  but do not work.

  Can you help me?

  Concerning

  Frédéric

  You must ensure that there is no NAT 0 ACL statement because it will take precedence over the static NAT.

  You don't need:

  Global 172.26.0.1 - 172.26.0.254 10 (outside)

  NAT (inside) 10 access-list nattoyr

  Because it will be replaced by the static NAT.

  In a Word is enough:

  nattoyr to access ip 10.0.0.0 scope list allow 255.255.255.0 10.1.252.0 255.255.255.0

  access extensive list ip 172.26.0.0 vpntoyr allow 255.255.255.0 10.1.252.0 255.255.255.0

  public static 172.26.0.0 (inside, outside) - nattoyr access list

  card crypto outside_map 2 match address vpntoyr

  card crypto outside_map 2 pfs set group5

  card crypto outside_map 2 defined peer "public ip".

  card crypto outside_map 2 game of transformation-ESP-AES-256-SHA

  outside_map interface card crypto outside

  tunnel-group "public ip" type ipsec-l2l

  tunnel-group "public ip" ipsec-attributes

  pre-shared key *.

  -Make sure that it not there no NAT ACL 0 including the above statements and check if NAT happening (sh xlate) and the

  traffic is being encryption (sh cry ips its)

  Federico.

• Static - VPN Site to Site DMVPN Tunnel

  Hello

  I have two sites, Site-a with Cisco ASA 5505 static IP Configuration & Site-B 1841 Cisco ISR with dynamic IP Configuration.

  See the diagram attached for a glimpse.

  The goal is to have the tunnel VPN Site to Site between the site of two so that desktop sitting in Site B can access the server applications residing in the Site-A.

  Please suggest

  Concerning

  @Mohammed

  Hello

  A site to Site IPSec, the ASA is the static side and he should have the 'dynamic' configuration, and the side Dynamics SRI 1841 should have the static side:

  I'll give an example configuration to achieve, but you can use a different encryption algorithms:

  ASA 5505:

  Phase 1:

  crypto ISAKMP policy 1

  3des encryption

  md5 hash

  preshared authentication

  Group 2

   
  IPSec-attributes tunnel-group DefaultL2LGroup

  pre-shared-key cisco123

   

• Can VPN site-to-site with just 1 static IP address in PIX?

  Hi all

  Can I use pix for VPN with just 1 static IP address as follows:

  LAN-A---PIX1---INTERNET---PIX2---LAN-B

  Just PIX1 has static IP, PIX2 use DHCP from ISP. I have the config this type of VPN with another brand equipment. But the use of PIX, I just VPN config with both ends have a static IP and I can't find any information in the web site. Because when config VPN site-to-site I have to use the command 'same game '.

  Can someone tell me how can I do with PIX? Thank you!

  Best regards

  Teru Lei

  You just need to set up a dynamic encryption on PIX 1 card and a card standard encryption with a peer 'set' on 2 PIX. Here is an example configuration:

  http://www.Cisco.com/warp/public/110/dynamicpix.html

  Note that it also has VPN connection clients in 1 PIX (Lion), so forget all orders of "vpngroup" that you see in his configuration cause, they are not necessary for your scenario.

• VPN site to Site with NAT

  Hello Experts

  We intend to set up a VPN site-to site between two sites, sites, Site & A B such as shown in the attached diagram.

  The LAN on SIte A is 10.8.1.0/24 who are planning to NAT on the ASA5505 to 192.168.42.0/24 because this is the range that is allowed on the firewall on the remote end (Site B ASA 5520)

  What type of configuration requires we on the firewall of the Site regarding the interesting traffic.

  Natted IPs will be the interesting traffic?

  Is there another thing we have in other mind while configuring the ASA for the scenarios.

  Help would be appreciated.

  ACL "crypto-NAT" of my example will be the NAT traffic that source of 10.8.1.0/24 for 10.3.0.0/24 to match 192.168.42.0/24.

  For example:

  10.8.1.1 will be coordinated to 192.168.42.1 when traffic is destined to the 10.3.0.0/24 subnet.

  10.8.1.2 will be coordinated to 192.168.42.2 when traffic is destined to the 10.3.0.0/24 subnet.

  etc etc.

  If you have another remote subnet, you are right, you just add the extra line to the crypto-NAT and crypto-ACL. So, you will have the following lines:

  IP 10.8.1.0 allow Access-list crypto-NAT 255.255.255.0 10.3.0.0 255.255.255.0

  10.8.1.0 IP Access-list crypto-NAT 255.255.255.0 allow 10.5.0.0 255.255.0.0

  Crypto ip 192.168.42.0 access list ACL allow 255.255.255.0 10.3.0.0 255.255.255.0

  Crypto ip 192.168.42.0 access list ACL allow 255.255.255.0 10.5.0.0 255.255.0.0

• VPN site-to-site dynamic-to-static

  Dear

  I have a few sites already connected with ASA 5505 VPN site to site with both ending static IP address.  Normally, all traffic can be found without any problems.  Even, I used 'inside access management' for the two ASA.

  Now I have a new office with only the ADSL pppoe.  I used to install between Site B:remote the site dynamic IP and IP SiteA:static with a similar example of this easy VPN: http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a00805733df.shtml

  All my ASA 5505 run 1 8.4 (4)

  Site A - Static IP

  Site B - Dynamic IP with pppoe connection.

  After EasyVPN connected, I don't know how I remote manangment of the site a lan at the ASA 5505 B site?

  Best regards

  Alan.

  If you're ok with or the other solution, it is probably easier to use dynamic to static lan-to-lan, so, at least, that your solution is consistent and fair use lan-to-lan tunnel instead of customer vpn solution mixture and lan-to-lan.