Static across an IOS to IOS VPN

Answered Question

I have a situation where I own both sides of a VPN tunnel between IOS boxes with no NAT at all. However, I have 2 servers that I now have to static NAT to two brand new IP addresses to meet network requirements on the "far" end. Unfortunately I never NAT on an IOS device--always a PIX/ASA or VPN-3000 box, and just haven't gotten the hang of it from the configuration examples.

A basic example of how to do this (without NATing any of the other traffic) would be greatly appreciated.

I have this problem too.
0 votes
Correct Answer by sundar.palaniappan about 9 years 5 months ago

Just configure static NAT for both servers. Here's a sample config.

int e0

description 'LAN'

ip address 172.16.1.1 255.255.255.0

ip nat inside

int e1

description 'Internet'

ip address 192.168.1.1 255.255.255.248

ip nat outside

ip nat inside source static 172.16.1.254 10.1.1.254

172.16.1.254 --> Real Address of the Server.

10.1.1.254 --> Global address of the Server to which the far end user sends traffic to.

HTH

Sundar

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Correct Answer
sundar.palaniappan Mon, 06/25/2007 - 15:18

Just configure static NAT for both servers. Here's a sample config.

int e0

description 'LAN'

ip address 172.16.1.1 255.255.255.0

ip nat inside

int e1

description 'Internet'

ip address 192.168.1.1 255.255.255.248

ip nat outside

ip nat inside source static 172.16.1.254 10.1.1.254

172.16.1.254 --> Real Address of the Server.

10.1.1.254 --> Global address of the Server to which the far end user sends traffic to.

HTH

Sundar

sundar.palaniappan Tue, 06/26/2007 - 15:50

There's no need for explicit NAT rules for other traffic and they would continue to pass un-natted. The one thing you would have to do is, if you aren't doing GRE tunneling with IPSEC, your crypto access list should permit traffic to the NAT (global) address of the Server to be encrypted. The other side should mirror this access list.

HTH

Sundar

Actions

This Discussion