Help with NAT outside and VPN

Unanswered Question
Aug 29th, 2007


I have a situation that requires me to NAT the source IPs that are coming through a VPN connnection.

My setup is as such:

A PIX501 acting as a concentrator for 5-6 VPNs (IPSEC) into my network. Just ONE of those VPNs that terminates on the PIX needs to have it's source IPs NATd to work on my network. The addresses coming across are 192.168.0.X and they need to be natted to 192.168.4.X

Now, I learned that I can use the following commands to take care of this problem (thanks jon.marshall):

global (inside) 3 netmask

global (inside) 3 netmask

nat (outside) 3 outside

From what I understand, the above statments will translate the addresses coming in through a VPN that are to a 192.168.4.X address... 1 to 1 first, then overload the last address.

The above commands worked fine in a Lab situation, where I had only 1 VPN setup between two pixes. When we put the commands in to the production environment, all the other VPNs died. When we took out the nat(outside) 3 .... command, everything started to work again, except of course the VPN that needed the nat haha. Ideas?

Please note, The above commands are the ONLY commands that are global(inside) and nat(outside). Is there somthing that's missing? Do we need a nat(outside) 0 command of some sort maybe? Thanks in advance!

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jon Marshall Wed, 08/29/2007 - 13:02

Hi Ryan

There should be no problems with this config as long as the other VPN source IP addresses don't conflict. We have a production firewall that has many VPN's, some translating the source IP's and some not.

Could you post the config (minus any sensitive info).

Note that you don't have to have any nat statements on the outside for VPN's that you don't want to NAT source IP's.

Other thing to do would be to add a second VPN in your lab environment that you aren't doing NAT on the source IP addresses and see if you can replicate the problem.


rtjensen4 Thu, 08/30/2007 - 06:32

Ok, I've taken out quite a bit of stuff... Hopefully not too much. The VPN in question is related to

Access-list 105

Global(inside) 3

Crypto map "MAP" section 50

The issue happens when we issue the nat (outside) outside

command, this is what breaks everything.

Thanks in advance.


This Discussion