outside nat on ASA

Unanswered Question
May 9th, 2007
User Badges:

Hi, my customer has a l2l tunnel between ASA outside and a router. He also wants to nat on outside to translate

incoming addresses onto outside interface to inside interface. This is the opposite as it is done normally.

The tunnel comes up but no data traffic is possible.

May he have a conflict as tunnel ends on outside and nat is also on outside?

Does anybody have an idea?

Regards Guenther

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
acomiskey Wed, 05/09/2007 - 06:15
User Badges:
  • Green, 3000 points or more

Could you post clean ASA config?

Jon Marshall Wed, 05/09/2007 - 06:40
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Hi Guenther

If i understand correctly yes it can be done. We have this setup on one of our firewalls.

Basically NAT is done after the IPSEC when coming from outside to inside so an example

This is your crypto map access-list

access-list customer1 permit ip host

You could then have the following

nat (outside) 1 outside

global (inside) 1 interface

This should work. I have not actually used the inside interface for NAT as i chose a separate subnet for the translations ie

nat (outside) 1 outside

global (inside) 1

but i can't see why you are trying wouldn't work.



gseiler Fri, 05/11/2007 - 01:08
User Badges:

Hi, thanks for feedbacks. My customer got it working when he removed nat-control. Strange, but he will not do any more testing and keep it running as it works now. Regards Guenther


This Discussion