I need a tunnel with NAT

Unanswered Question

Pix 515 6.3(3) has a pix to pix VPN, then, it has some vpn clients, all they are working fine, however, I need an aditional VPN to a VPN concentrator, and I have a problem, for security policies the partner which I need to connect does not permit my internal ip address, then I need to make NAT in order to get access to its network.

my internal is address, but need to make NAT to, But i do not know how to establish that nat and the access-lists.

can somebody help me ??

Martin C

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
eric_hanke Thu, 07/05/2007 - 11:38

I am having a similar issue. I have a Cisco PIX 501 that already has several site-to-site connections established.

I need to establish an additional VPN to a device that already has a connecton that uses the IP addresses on my LAN interface. Is there a way to NAT my LAN so I can establish the VPN without putting another piece of hardware in place?


Jon Marshall Thu, 07/05/2007 - 11:56

Hi Martin

Let assume the remote partner network is

Also lets assume you only want to NAT your addresses to when you access your partner network.

access-list pnat permit ip

nat (inside) 2 access-list pnat

global (outside) 2

The above makes sure your addresses are only natted to when going to the partner network.

Now you setup your pix to VPN concentrator VPN in the same way as you have setup your pix to pix VPN. The major difference is on the crypto map access-lsit on your pix. You must refer to the Natted addresses ie.

access-list vpntraffic permit ip




This Discussion