VPN with static nat for a whole subnet

Similar Questions

• Dual active/passive failover of ISP with static Nat on Cisco 1941

  Hello world

  I'm working on a configuration of a client and I have everything in place right now except the NAT' static ing.  The config fails during an ISP to another and track als and routes by default static weighted, the PAT rocking with course to each interface maps.  It is, is it possible to switch on the large amount of static NAT entries to the ISP of backup?  So far, everything I've read said no because you can have only one entry per ip/port combo, other than another configuration static NAT double server with a different IP address.  I just want to be sure before making my recommendations, all thoughts are greatly appreciated.

  Thank you

  Brandon

  In fact, you can also long as you use standard NAT ("ip nat inside source static") or not NVI ('ip nat static source') for your attackers. You apply the roadmap by the end of the static NAT statement to indicate which interface it should apply to. So, if you have something like this:

   ip access-list extended ACL_NAT permit ip 192.168.0.0 255.255.255.0 any ! route-map RM_NAT_ISP1 match ip address ACL_NAT match interface GigabitEthernet0/1 ! route-map RM_NAT_ISP2 match ip address ACL_NAT match interface GigabitEthernet0/2 

  Using port 80/tcp for example, you can do this:

   ip nat inside source static tcp x.x.x.x 80 y.y.y.y 80 route-map RM_NAT_ISP1 ip nat inside source static tcp x.x.x.x 80 z.z.z.z 80 route-map RM_NAT_ISP2 

  Just replace x.x.x.x with the LAN address of the machine that you are shipping y.y.y.y with the WAN address you are shipping on isps1 and z.z.z.z with the address of the ISP WAN you are shipping on ISP2. The static NAT will be conditional on the roadmap, at this point.

  This works with TCP, UDP, and IP forwarding, but does not require that you use an IPv4 address to your WAN address. For some reason, it does not work if you use an interface... so if you're using dynamic addresses, it will be more complicated.

• L2l VPN with IPSEC NAT

  Hi all!

  I have a question about L2L VPN and NAT.

  Can I set up the VPN tunnel between two ASAs or routers using the NAT translation from within the private IP addresses to a single public IP address outside the interface and then implement interesting crypto with the source of the public IP address and the destination of the remote private network on the other end (also ASA). For example, I want to translate a private network to the public ip address at one end and use the VPN tunnel with a public IP address as the source. Policy-NAT is not an option, because we really do not want to provide any IP address to the remote end, and IP addresses of the remote end can overlap with our end.

  Thank you!

  Hello

  You can definitely set up an IPSec tunnel between two devices in the translation of your subnet in a single public IP address. You just create the translation and as you mentioned define interesting traffic using the public IP address.

  This is exactly what we call political NAT, I don't understand why you say that NAT policy is not an option. Perhapps you misunderstood concept NAT policy or I misunderstood your question.

  For example, assuming that the LAN private at your side is 172.16.1.0/24, the remote subnet is 192.168.150.0/24, and that the public IP address that you want to use is 200.200.200.200 your NAT config should look like this:

  access-list 199 permit ip 172.16.1.0 255.255.252.0 192.168.150.0 255.255.255.0

  Global (outside) 6 200.200.200.200

  NAT (inside) 6 access-L199

  Which would be NAT traffic to the public IP address only when the traffic matches the ACL.

  Your ACL crypto should then be something like

  cryptomap list of allowed access host ip 200.200.200.200 192.168.150.0 255.255.255.0

  That would hide your address real and all they see is the public IP address you give them. Note that since the NAT takes place on your side your side will be able to raise the tunnel.

  I hope this helps.

  Raga

• ASA ASA Site2Site VPN with dynamic NAT in version 8.2

  I did everything for NAT to 9.x and I don't have much at all with NAT in 8.2 and earlier with this configuration.

  I have some local subnets:

  172.30.1.0/24
  172.30.16.0/24
  172.30.3.0/24
  172.30.12.0/24
  172.30.7.0/24
  172.30.35.0/24

  who will need to access a remote subnet:

  10.31.255.128/25

  and the requirement is to NAT the following text:

  A lot of requirement much NAT.
  172.30.1.0/24 NAT at 192.168.104.0/24
  172.30.16.0/24 NAT at 192.168.105.0/24
  172.30.3.0/24 NAT at 192.168.108.0/24
  172.30.12.0/24 NAT at 192.168.106.0/24
  172.30.7.0/24 NAT at 192.168.107.0/24
  172.30.35.0/24 NAT at 192.168.103.0/24

  When you go to the 10.31.255.128/25 subnet.

  Here's what I think, I need and I'm looking for confirmation and/or messages.

  Config group *.

  object-group, LAN using a NAT-NETWORKS
  192.168.104.0 subnet 255.255.255.0
  192.168.105.0 subnet 255.255.255.0
  192.168.108.0 subnet 255.255.255.0
  192.168.106.0 subnet 255.255.255.0
  192.168.107.0 subnet 255.255.255.0
  192.168.103.0 subnet 255.255.255.0

  Group of objects to REMOTE-network
  subnet 10.31.255.128 255.255.255.128

  ACL for the crypto-card *.

  REMOTE_cryptomap_72 list extended access permitted ip object-group LOCAL-using a NAT-NETWORKS-group of objects to REMOTE-NETWORK

  Config NAT

  NAT (inside) 10 172.30.1.0 255.255.255.0
  NAT (inside) 20 172.30.16.0 255.255.255.0
  NAT (inside) 30 172.30.3.0 255.255.255.0
  NAT (inside) 40 172.30.12.0 255.255.255.0
  NAT (inside) 50 172.30.7.0 255.255.255.0
  NAT (inside) 60 172.30.35.0 255.255.255.0

  Global (outside) 10 192.168.104.0 255.255.255.0
  Global (outside) 20 192.168.105.0 255.255.255.0
  Global (outside) 30 192.168.108.0 255.255.255.0
  Global (outside) 40 192.168.106.0 255.255.255.0
  Global (outside) 50 192.168.107.0 255.255.255.0
  Global (outside) 60 192.168.103.0 255.255.255.0

  This sets up the set of transformation which is called in the Crypto map.* *.

  Crypto ipsec transform-set ikev1 REMOTE-SET esp-3des esp-sha-hmac

  This sets up the Crypto map.* *.

  address for correspondence card crypto outside_map 72 REMOTE_cryptomap_72
  peer set card crypto outside_map 72 5.5.5.4
  card crypto outside_map 72 set transform-set REMOTE-SET ikev1
  outside_map card crypto 72 the value reverse-road

  Implements IKE *.

  IKEv1 crypto policy 72
  sha hash
  preshared authentication
  Group 2
  lifetime 28800
  3des encryption

  Sets up the Group of tunnel (connection profile) *.

  tunnel-group 5.5.5.4 type ipsec-l2l
  IPSec-attributes tunnel-group 5.5.5.4
  IKEv1 pre-shared-key * TBD *.

  Thank you

  Mike

  With your existing global declarations, my suggestion should meet the requirement. Here is some additional info: http://www.cisco.com/c/en/us/td/docs/security/asa/asa82/configuration/gu...

• ASA to Juniper VPN with policy NAT

  I'm trying to configure a VPN tunnel between a remote site 66.18.106.160/27 and my network 192.168.190.0/24 client.  I need NAT all traffic leaving 192.168.190.0/24 to 192.168.191.0/24.

  Here is my current config:

  xxxxx host name

  domain xxxxx.local
  enable the encrypted password xxxxx
  XXXXX encrypted passwd
  names of
  !
  interface Vlan1
  nameif inside
  security-level 100
  IP 192.168.190.1 255.255.255.0
  !
  interface Vlan2
  nameif outside
  security-level 0
  IP 207.98.218.26 255.255.255.248
  !
  interface Vlan3
  prior to interface Vlan1
  nameif DMZ
  security-level 50
  IP 192.168.100.1 address 255.255.255.0
  !
  interface Vlan12
  description of interface vlan2 backup
  nameif CharterBackup
  security-level 0
  IP 72.14.9.50 255.255.255.248
  !
  interface Ethernet0/0
  switchport access vlan 2
  !
  interface Ethernet0/1
  !
  interface Ethernet0/2
  switchport access vlan 12
  !
  interface Ethernet0/3
  !
  interface Ethernet0/4
  !
  interface Ethernet0/5
  !
  interface Ethernet0/6
  switchport access vlan 3
  !
  interface Ethernet0/7
  switchport access vlan 3
  !
  passive FTP mode
  DNS server-group DefaultDNS
  domain xxxxx.local
  access-list extended 110 permit ip 192.168.190.0 255.255.255.0 192.168.10.0 255.255.255.0
  access-list extended 110 permit ip 192.168.190.0 255.255.255.0 66.18.106.160 255.255.255.224
  access-list extended 110 permit ip 192.168.191.0 255.255.255.0 66.18.106.160 255.255.255.224
  access-list extended 100 permit tcp any host 207.98.218.27 eq 3389
  access-list extended 100 permit tcp any host 207.98.218.28 eq 3389
  access-list extended 100 permit tcp any host 207.98.218.27 eq 9000
  access-list extended 100 permit tcp any host 207.98.218.27 eq 9001
  access-list extended 100 permit tcp any host 207.98.218.28 eq 9000
  access-list extended 100 permit tcp any host 207.98.218.28 eq 9001
  access-list standard split allow 192.168.190.0 255.255.255.0
  Access extensive list ip 192.168.190.0 POLICYNAT allow 255.255.255.0 66.18.106.160 255.255.255.224
  extended VPN ip 192.168.191.0 access list allow 255.255.255.0 66.18.106.160 255.255.255.224
  pager lines 24
  asdm of logging of information
  Within 1500 MTU
  Outside 1500 MTU
  MTU 1500 DMZ
  MTU 1500 CharterBackup
  IP local pool vpnpool 192.168.10.75 - 192.168.10.85
  no failover
  ICMP unreachable rate-limit 1 burst-size 1
  ASDM image disk0: / asdm - 524.bin
  don't allow no asdm history
  ARP timeout 14400
  Global 1 interface (outside)
  Global interface (CharterBackup) 1
  NAT (inside) - 0 110 access list
  NAT (inside) 1 0.0.0.0 0.0.0.0
  NAT (DMZ) 1 0.0.0.0 0.0.0.0
  public static 192.168.191.0 (inside, outside) - POLICYNAT access list
  Access-group 100 in external interface
  Route outside 0.0.0.0 0.0.0.0 207.98.218.25 1 track 1
  Route 0.0.0.0 CharterBackup 0.0.0.0 71.14.9.49 254
  Timeout xlate 03:00
  Timeout conn 01:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
  Sunrpc timeout 0:10:00 h323 0:05:00 h225 mgcp from 01:00 0:05:00 mgcp-pat 0:05:00
  Sip timeout 0:30:00 sip_media 0:02:00 prompt Protocol sip-0: 03:00 sip - disconnect 0:02:00
  Timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
  Enable http server
  http 192.168.190.0 255.255.255.0 inside
  No snmp server location
  No snmp Server contact
  Server enable SNMP traps snmp authentication linkup, linkdown cold start
  monitor SLA 123
  type echo protocol ipIcmpEcho 4.2.2.2 outside interface
  timeout of 1000
  frequency 3
  Annex ALS life monitor 123 to always start-time now
  Crypto ipsec transform-set esp - esp-md5-hmac romanset
  Crypto ipsec transform-set esp-aes - AES-128-SHA esp-sha-hmac
  Crypto-map dynamic dynmap 10 transform-set romanset
  romanmap card crypto 10 corresponds to the VPN address
  peer set card crypto romanmap 10 66.18.99.68
  card crypto romanmap 10 game of transformation-AES-128-SHA
  map romanmap 65535-isakmp ipsec crypto dynamic dynmap
  romanmap interface card crypto outside
  crypto isakmp identity address
  crypto ISAKMP allow outside
  crypto ISAKMP policy 10
  preshared authentication
  the Encryption
  md5 hash
  Group 2
  life 86400
  crypto ISAKMP policy 20
  preshared authentication
  aes encryption
  sha hash
  Group 2
  life 86400
  !
  track 1 rtr 123 accessibility
  Telnet 0.0.0.0 0.0.0.0 inside
  Telnet timeout 5
  SSH 0.0.0.0 0.0.0.0 outdoors
  SSH 0.0.0.0 0.0.0.0 CharterBackup
  SSH timeout 5
  Console timeout 0
  management-access inside
  dhcpd dns 8.8.8.8
  dhcpd outside auto_config
  !
  dhcpd address 192.168.100.100 - DMZ 192.168.100.130
  dhcpd enable DMZ
  !

  internal group xxxxx policy
  attributes of the strategy group xxxxx
  value of server WINS 192.168.190.3
  value of server DNS 192.168.190.3
  Split-tunnel-policy tunnelspecified
  Split-tunnel-network-list value split
  tunnel-group xxxxx type ipsec-ra
  tunnel-group xxxxx General attributes
  address vpnpool pool
  Group Policy - by default-romangroup
  tunnel-group ipsec-attributes xxxxx
  pre-shared-key *.
  ISAKMP ikev1-user authentication no
  tunnel-group 66.18.99.68 type ipsec-l2l
  IPSec-attributes tunnel-group 66.18.99.68
  pre-shared-key *.
  !
  class-map inspection_default
  match default-inspection-traffic
  !
  !
  type of policy-card inspect dns preset_dns_map
  parameters
  message-length maximum 512
  Policy-map global_policy
  class inspection_default
  inspect the preset_dns_map dns
  inspect the ftp
  inspect h323 h225
  inspect the h323 ras
  inspect the rsh
  inspect the rtsp
  inspect esmtp
  inspect sqlnet
  inspect the skinny
  inspect sunrpc
  inspect xdmcp
  inspect the sip
  inspect the netbios
  inspect the tftp
  !
  global service-policy global_policy
  context of prompt hostname

  Currently, traffic that originates on 192.168.190.0/24 generates no traffic phase 1.  However, if the traffic is coming in FRO the side remote (66.18.106.160/27) the tunnel arrives, but no traffic passes.

  Although this isn't my area of expertise, it seems to me that my ASA is not 'see' interesting traffic from 192.168.190.0/24 will 66.18.106.160/27.

  Any help you could provide would be GREATLY appreciated.

  Just remove the 2 following lines:

  access-list extended 110 permit ip 192.168.190.0 255.255.255.0 66.18.106.160 255.255.255.224

  access-list extended 110 permit ip 192.168.191.0 255.255.255.0 66.18.106.160 255.255.255.224

  Then 'clear xlate '.

  That should solve your problem.

• workspace with a nat for external access device

  I have installad workspace with just 1 gateway, it works well form my internal network. Now, I need to access from the internet. I do not have a load balancer, but just a firewall that can NAT my assresses international to a public address.

  I set my firewall to redirect all traffic from https://pubblic_address to the horizon: workspacegatewayIP:443 but when with a browser I point to https://pubblic_address I get:

  https://a3cadgateway.xyz.internal/SaaS/auth/login?dest=https :// a3cadgateway.xyz.internal:443/web

  SERVER NOT FOUND

  
  

  What should I do to provide external access to the gateway? Please can someone season me how to configure my firewall?

  The important part is to page 37, what did you set up here? The internal or external URL?

• Static NAT problem with PIX501

  Hi all

  We have problems with our PIX firewall. We have configured PIX 501 with static NAT for our Web server. Here's the running configuration.

  6.3 (4) version PIX

  interface ethernet0 car

  interface ethernet1 100full

  ethernet0 nameif outside security0

  nameif ethernet1 inside the security100

  pixfirewall hostname

  domain ciscopix.com

  fixup protocol dns-length maximum 512

  fixup protocol ftp 21

  fixup protocol h323 h225 1720

  fixup protocol h323 ras 1718-1719

  fixup protocol http 80

  fixup protocol rsh 514

  fixup protocol rtsp 554

  fixup protocol sip 5060

  fixup protocol sip udp 5060

  fixup protocol 2000 skinny

  fixup protocol smtp 25

  fixup protocol sqlnet 1521

  fixup protocol tftp 69

  names of

  access-list 101 permit tcp any host x.x.x.26 eq www

  access-list 101 permit tcp any host x.x.x.26 EQ field

  access-list 101 permit udp any host x.x.x.26 EQ field

  pager lines 24

  Outside 1500 MTU

  Within 1500 MTU

  IP address outside x.x.x.28 255.255.255.248

  IP address inside 192.168.90.1 255.255.255.0

  alarm action IP verification of information

  alarm action attack IP audit

  location of PDM 192.168.90.0 255.255.255.0 inside

  history of PDM activate

  ARP timeout 14400

  Global 1 interface (outside)

  NAT (inside) 1 0.0.0.0 0.0.0.0 0 0

  static (inside, outside) x.x.x.26 192.168.90.3 netmask 255.255.255.255 0 0

  Access-group 101 in external interface

  Route outside 0.0.0.0 0.0.0.0 x.x.x.25 1

  Route inside 192.168.1.0 255.255.255.0 192.168.90.2 1

  Timeout xlate 03:00

  Timeout conn 01:00 half-closed 0:10:00 udp 0: CPP 02:00 0:10:00 01:00 h225

  H323 timeout 0:05:00 mgcp 0: sip from 05:00 0:30:00 sip_media 0:02:00

  Timeout, uauth 0:05:00 absolute

  GANYMEDE + Protocol Ganymede + AAA-server

  AAA-server GANYMEDE + 3 max-failed-attempts

  AAA-server GANYMEDE + deadtime 10

  RADIUS Protocol RADIUS AAA server

  AAA-server RADIUS 3 max-failed-attempts

  AAA-RADIUS deadtime 10 Server

  AAA-server local LOCAL Protocol

  Enable http server

  http 192.168.90.0 255.255.255.0 inside

  No snmp server location

  No snmp Server contact

  SNMP-Server Community public

  No trap to activate snmp Server

  enable floodguard

  Telnet timeout 5

  SSH timeout 5

  Console timeout 0

  Terminal width 80

  : end

  the problem is the configuration, we are unable to access the web server both inside and outside the network.

  All input will be greatly appreciated.

  Kind regards

  udimpas

  activate icmp backtrace and then ping the x.x.x.26 of the internet. the output should be as below:

  3363574:-out ICMP echo request: ID = 21834 seq = 1202 length = 80

  3363575: ICMP echo request: external untranslating: inside: 192.168.90.3

  3363576: ICMP echo-reply from the inside: 192.168.90.3 ID = 21834 seq = 1202 length = 80

  3363577: response to ICMP echo -: translate inside: 192.168.90.3 out:

  by doing this, you can 1. Check the nat 2. If the server responds to the internet.

  do not forget to allow incoming icmp:

  access-l 101 permit icmp any one

• I need VPN gateway to gateway with NAT for several subnets, RV082

  I have a pair of RV082 routers and I would like to configure a gateway to gateway VPN tunnel, as described in a book, "How to configure a VPN tunnel that routes all traffic to the remote gateway," (name of file Small_business_router_tunnel_Branch_to_Main.doc).  I followed this recipe book and found that my while the main office has internet connectivity, the branch subnet is not an internet connection.

  Routing behaves as advertised, where all traffic goes to the seat.  However, the 192.168.1.0 subnet in the branch receives no internet connectivity.  I read in other posts that the main router will provide only NAT for the local subnet, not the Management Office subnet.  Is it possible to configure the RV082 router to provide NAT for all subnets?

  If this is not the case, what product Cisco will provide connectivity VPN Tunnel as well as the NAT for all subnets?  The RV082 can be used as part of the final solution or are my RV082s a wasted expense?

  Here is the configuration that I had put in place, (real IP and IKE keys are false).

  Bridge to bridge

  Remote Head Office

  Add a new Tunnel

  No de tunnel                  1                                               2

  Name of the tunnel:, n1 n1-2122012_n2-1282012-2122012_n2-1282012

  Interface: WAN1 WAN1

  Enable :                   yes                                             yes

  --------------------------------------------------------------------------------

  Configuration of local groups

  Type of local security gateway: IP only IP only

  IP address: 10.10.10.123 10.10.10.50

  Local security group type: subnet subnet

  IP address: 192.168.1.0 0.0.0.0

  Subnet mask: 255.255.255.0 0.0.0.0

  --------------------------------------------------------------------------------

  Configuration of the remote control groups

  Remote security gateway type: IP only IP only

  IP address: 65.182.226.50 67.22.242.123

  Security remote control unit Type: subnet subnet

  IP address: 0.0.0.0 192.168.1.0

  Subnet mask: 0.0.0.0 255.255.255.0

  --------------------------------------------------------------------------------

  IPSec configuration

  Input mode: IKE with preshared key IKE with preshared key

  Group of the phase 1 of DH: Group 5 - 1536 bit group 5 - 1536 bit

  Encryption of the phase 1: of THE

  The phase 1 authentication: MD5 MD5

  Step 1 time in HIS life: 2800 2800 seconds

  Perfect Forward Secrecy: Yes Yes

  Group of the phase 2 DH: Group 5 - 1536 bit group 5 - 1536 bit

  Encryption of the phase 2: of THE

  Phase 2 of authentication: MD5 MD5

  Time of the phase 2 of HIS life: 3600 seconds 3600 seconds

  Preshared key: MyKey MYKey

  Minimum complexity of pre-shared key: Enable Yes Enable

  --------------------------------------------------------------------------------

  If you are running 4.x firmware on your RV082, you must add an additional Allow access rule for the Branch Office subnet (considered one of the multiple subnets in the main office) may have access to the internet. Note the firmware version has more details about it.

  http://www.Cisco.com/en/us/docs/routers/CSBR/rv0xx/release/rv0xx_rn_v4-1-1-01.PDF

• Cisco IOS - how config static nat to NAT on the VPN

  Hello world

  I need help.

  I configured a VPN site-to site between two routers IOS. One of the routers already had a static NAT (172.16.100.1 inside to the public IP address), but this static NAT prevents remote VPN hosts access to the 172.16.100.1 home as it tries to the response to public IP NAT router configured.

  Does anyone know how to use static NAT for the inside to the outside, but don't not NAT inside to outside VPN traffic?

  I know how to make using a roadmap for "overload" dynamic NAT, but I can't? t see how you can use a roadmap on the static NAT statement.

  You can provide any help would be appreciated.

  Chris

  Hi Chris

  Take a look at the document atatched with gives a few examples of the very thing you are trying to do.

  http://www.Cisco.com/en/us/products/SW/iosswrel/ps1839/products_feature_guide09186a0080087bac.html

  HTH

  Jon

• PIX v6.3 Site-to-Site with policy NAT

  Hi guys,.

  I need to set up a site to site with nat because we have overlapping subnet at the other end.

  They need access to both servers on our network with IP static.

  Site A: 192.168.100.0/24

  Site b: 192.168.200.128/25

  The other site has chosen this network for NAT: 10.200.50.0/28

  I need to translate

  192.168.100.10 > 10.200.50.2

  192.168.100.20 > 10.200.50.3

  through the tunnel

  That's what I've done so far, will this work? Any problem that may appear with this config?

  Crypto ACL:

  VPN ip 10.200.50.0 access list allow 255.255.255.240 192.168.200.128 255.255.255.128

  Policy_NAT1 list of allowed access host ip of 192.168.100.10 192.168.200.128 255.255.255.128

  Policy_NAT2 list of allowed access host ip 192.168.100.20 192.168.200.128 255.255.255.128

  NAT (inside) 10 access-list Policy_NAT1 0 0

  NAT (inside) 11 access-list Policy_NAT2 0 0

  overall 10 10.200.50.2 (outside)

  Overall 11 10.200.50.3 (outside)

  Thanks in advance!

  Hello

  Your configuration looks very good.

  Although I guess it's a dynamic configuration policy NAT/PAT.

  Incase you want to configure static policy NAT, you need to change a bit. I mean if you wanted a NAT configuration allowing to form bidirectional connection. Both from your site to the remote site and the remote site to your side. You can always use the same ACL you have configured, but you would use the "static" configurations.

  public static 10.200.50.2 (inside, outside) - Policy_NAT1 access list

  public static 10.200.50.3 (inside, outside) - Policy_NAT2 access list

  Review with the static NAT to politics and the dynamic policy NAT/PAT which would be if these hosts have static NAT configured at the direction of the 'outside' interface while static NAT would cancel both of these configurations.

  If you use the political dynamic NAT and had also a static NAT for the host, then you would have to change from the above static NAT in a policy to override the static NAT.

  And with the foregoing in mind possible existing static NAT and new static NAT of policy might have some problems as a whole. In this case the scheduling of NAT rules would determine if static NAT of the policy has been applied already. If you already had the configured static NAT then it would nullify the political new static NAT:. The solution would be to remove the static NAT and enter it again. This would move the static NAT once the static NAT to policy in the order that they appear on the CLI format configuration and, therefore, static political NAT would work for the specified destination and addresses the static NAT for all other destination addresses.

  Hope I made any sense

  Feel free to ask more if necessary while

  -Jouni

• L2l VPN with public ip of the router and firewall with private IP

  Dear all,

  I have a requiremnt for site to site VPN configuration but the firewall on the remote end is not obtained public ip, public ip address is termintaed on the router. Please find the attached diagram

  LAN--> Firewall - privateip--> router-publicip - ISP

  How can I set up the site to site VPN tunnel, enjoy emergency assistance

  Thanks in advance...

  Mikael

  You can configure static NAT for 1:1 for the SAA outside interface with a spare public ip address of the router address.

  If you don't have spare public ip address, then you must configure static UDP/500 and UDP/4500 PAT on the router and enable NAT - T on the SAA.

• Cisco ASA Site to Site VPN IPSEC and NAT question

  Hi people,

  I have a question about the two Site to Site VPN IPSEC and NAT. basically what I want to achieve is to do the following:

  ASA2 is at HQ and ASA1 is a remote site. I have no problem setting a static static is a Site to IPSEC VPN between sites. Guests residing in 10.1.0.0/16 are able to communicate with hosts in 192.168.1.0/24, but what I want is to configure the NAT with IPSEC VPN for this host to 10.1.0.0/16 will communicate with hosts in 192.168.1.0/24 with translated addresses

  Just an example:

  N2 host (10.1.0.1/16) contacted N1 192.168.1.5 with destination host say 10.23.1.5 No 192.168.1.5 (notice the last byte is the same in the present case,.5)

  The translation still for the rest of the communication (host pings ip destination host 10.23.1.6 N3 N2 not 192.168.1.6 new last byte is the same)

  It sounds a bit confusing to me, but I've seen this type of configuration before when I worked for the supplier of managed services where we have given our customers (Ipsec Site to Site VPN with NAT, don't know how it was setup)

  Basically we contact the customer via site-to-site VPN hosts but their real address were hidden and we used as translated address more high 10.23.1.0/24 instead of (real) 192.168.1.0/24, last byte must be the same.

  Grateful if someone can shed some light on this subject.

  Hello

  OK so went with the old format of NAT configuration

  It seems to me that you could do the following:

  • Configure the ASA1 with static NAT strategy
    • access-list L2LVPN-POLICYNAT allowed ip 192.168.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    • public static 10.23.1.0 (inside, outside) access-list L2LVPN-POLICYNAT
  • Because the above is a static NAT of the policy, this means that the translation will be made only when the destination network is 10.1.0.0/16
  • If you have for example a PAT basic configuration to inside-> external traffic, the above NAT configuration and the custom of the actual configuration of PAT interfere with eachother
  • ASA2 side, you can normally configure NAT0 / NAT Exemption for the 10.1.0.0/16 network
    • Note of the INTERIOR-SHEEP access-list SHEEP L2LVPN
    • the permitted INSIDE SHEEP 10.1.0.0 ip access list 255.255.0.0 10.23.1.0 255.255.255.0
    • NAT (inside) 0-list of access to the INTERIOR-SHEEP
  • You will need to consider that your access-list defining the VPN encrypted L2L traffic must reflect the new NAT network
    • ASA1: allowed to access-list L2LVPN-ENCRYPTIONDOMAIN ip 10.23.1.0 255.255.255.0 10.1.0.0 255.255.0.0
    • ASA2: list L2LVPN-ENCRYPTIONDOMAIN allowed ip 10.1.0.0 access 255.255.0.0 10.23.1.0 255.255.255.0

  I could test this configuration to work tomorrow but I would like to know if it works.

  Please rate if this was helpful

  -Jouni

• Static NAT & DMVPN Hub

  Hello

  I don't think that will be a problem DMVPN supports the rays behind NAT devices, but I anticipate change my network for reasons of security and redudancy autour and putting a pair of ASA firewalls on my Internet collocation.  Right now I have a DMVPN race 3845, NAT & ZBFW.  I'm going to remove the ZBFW and move the NAT to the ASA, leaving only the DMVPN hub and routing.  If I create a static NAT mapping on my ASA to point to the DMVPN hub that will work?

  I think it will be, but I just wanted to be 110% sure.

  Thank you!

  Hi Brantley,

  DMVPN with static NAT on the hub is supported in the installer. Just be awear it there are limits.

  1, all DMVPN router, hub and spokes must be running at least 12.3(9a) and 12.3 (11) T code.

  2, must use ipsec transport mode.

  3, so need dynamic tunnel talk to rays, hub should work at least 12.3 (13), 12.3 (14) T and 12.3 (11) T3 code.

  See the configuration guide

  http://www.Cisco.com/en/us/docs/iOS/sec_secure_connectivity/configuration/guide/sec_DMVPN_ps6350_TSD_Products_Configuration_Guide_Chapter.html#wp1122466

  HTH,

  Lei Tian

• Static NAT question

  Hi Experts,

  Please help me on this. I enclose my diagram network with this post.
  My firewall is cisco ASA 5510 running with version 8.4 of software. I set up static NAT for all three servers (in the diagram, server 1,2 and 3). The question is, the static NAT works only with the first server. No trades do go to other two server (2 and 3). All servers are in the DMZ.

  When I remove the static NAT for Server 2 and 3, all traffic going to the server with the IP WAN address of the firewall, which means that the dynamic NAT works. I am also attaching the configuration file.

  (NOTE: NAT works for the 72.16.34.1 Server)

  Kind regards
  Martin

  HI San,

  Would you be able to try this workaround: -.

  https://supportforums.Cisco.com/blog/149276/asapix-proxy-ARP-vs-gratuito...

  I think the problem is with the IP addresses provided by the ISP.

  Thank you and best regards,

  Maryse Amrodia

• VPN with external ip

  Hello

  I need to configure a tunnel VPN of our ASA 5200 (8.2.1) using an external ip address.

  That's what I wanted todo but do not know how:

  10.0.0.0/24--> Global nat (66.0.0.135)-> VPN-> other side 47.0.0.47

  I would like to have the option to use one of my hosts on the 10.0.0.0 network to capture a NAT.135 and go through this VPN tunnel but I'm not sure that is possible...

  My other option would be:

  10.0.0.10--> NAT 66.0.0.136-> VPN-> other side 47.0.0.47

  This isn't a good solution, because I need more internal host to talk to la.47 on the other end of the tunnel.

  My inner interface has 10.0.0.0/24

  my remote is 66.0.0.134/26

  Hi, Freddy.

  What you need is based on strategies of static nat for tunnel vpn site-to-site.

  Please click on Cisco doc link below, he explains how you can implement your solution.

  http://www.Cisco.com/en/us/products/ps6120/products_configuration_example09186a0080b37d0b.shtml

  Let me know if it helps.

  Thank you

  Rizwan James