Multihomed - Bothway Static NAT

kevindickerson · ‎09-17-2007

Hi All,

The situation is I have one VPN concentrator (ASA5505) which is connected through to a 2811, this in turn has 4 ADSL links, there are four sites which connect in to a specific ADSL line on the 2811. I have been able to successfully configure NAT for out bound connections so that connections from the ASA going to site 1 will go out via ADSL link 1 and connections from the ASA goign to site 2 will go out via ADSL link 2. However I have been having difficulties with either site1 or site2 being able to connect back to the ASA, the 2811 is not doing the reverse translation.

We know that the configuration of the ASA's at each end are correct as previously we had a 877 for each ADSL at the main site. But since terminating each ADSL link onto a single 2811 this is where the problems have started.

I have attached the relevant configuration for the router.

Any help would be appreciated.

lgijssel · ‎09-17-2007

This is because the NAT translation must exist before inbound traffic can be translated.

You will need different static translations to initialize the sessions:

http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a0080110c03.html#wp1027195

This also means that the VPN sessions cannot terminate on the same ip adress. You will have to assign a unique source adress on the ASA for each session. I have been trying to find info on this but have not been successfull.

I know that the ASA will accept all ip's in the outside subnet but I never tried to terminate a vpn to another adress than the interface. You should try that out yourself.

And another probably helpful link:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00807fbdc8.shtml

regards,

Leo

a.alekseev · ‎09-17-2007

>However I have been having difficulties with either site1 or site2 being able to connect back to the ASA, the 2811 is not doing the reverse translation.

It is not possible if you use "overload" in nat configuration.

kevindickerson · ‎09-17-2007

Unfortunately I do not appear to be able to remove the overload option as the IOS always addeds it back in even if it hasn't been added.