Hello Ercan,

You can do policy NAT on the ASA on both the sides. What you have to do is, change the IP Address of your internal network through policy NAT and use the changed address on the encryption ACL.

For eg: Site A internal network is 10.14.16.0/24 and you want it be changed to 10.19.1.0/24

access-list 188 permit ip 10.14.16.0 255.255.255.0 10.19.2.0 255.255.255.0

static (inside,outside) 10.19.1.0 access-list 188

encryption access-list

access-l 181 permit ip 10.19.1.0 255.255.255.0 10.19.2.0 255.255.255.0

The 10.19.2.0/24 network is the remote side network that I opted to change as. You can change it to whatever you want but, make sure you make the changes in the access-list accordingly

Or as you proposed you can change it to a single IP as well.

EG:

access-list 188 permit ip 10.14.16.0 255.255.255.0 10.19.2.1 255.255.255.255

nat (inside) 3 access-l 188

global (outside) 3 10.19.1.15

encryption access-list will be:

access-list 181 per ip host 10.19.1.15 host 10.19.2.1

Hope this answers your questions.

Rate this post, if it helps.

Thanks

gilbert