NAT incoming VPN Tunnel

Answered Question
Dec 8th, 2008
User Badges:

I have a new vpn tunnel that I would like to NAT to the internal network address space. The new tunnel is coming from 172.31.17.0 and the existing LAN on the ASA is 172.31.16.0 Is there a good solution to make the incoming tunnel hav a source address from the 172.31.16.0 network to access other resources?

Correct Answer by Jon Marshall about 8 years 5 months ago

Tom


Assuming it is a site-to-site VPN and assuming a spare IP address of 172.31.16.10


nat (outside) 2 172.31.17.0 255.255.255.0 outside

global (inside) 2 172.31.16.10


OR if you want to use the interface address


global (inside) 2 interface


Note i have used a nat-id of 2 in the example, just use a nat-id that is unused.


Jon

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Loading.
Jon Marshall Mon, 12/08/2008 - 13:27
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Tom


Is this a site-to-site VPN tunnel ?


Do you have a spare IP address in the 172.31.16.x subnet or do you want to use the inside interface address on the ASA ?


Jon

TJ Kelly Mon, 12/08/2008 - 13:38
User Badges:

Jon,


I could use either. The interface is 172.31.16.1 or I could utilize an open IP on the inside.


Tom

Correct Answer
Jon Marshall Mon, 12/08/2008 - 13:44
User Badges:
  • Super Blue, 32500 points or more
  • Hall of Fame,

    Founding Member

  • Cisco Designated VIP,

    2017 LAN, WAN

Tom


Assuming it is a site-to-site VPN and assuming a spare IP address of 172.31.16.10


nat (outside) 2 172.31.17.0 255.255.255.0 outside

global (inside) 2 172.31.16.10


OR if you want to use the interface address


global (inside) 2 interface


Note i have used a nat-id of 2 in the example, just use a nat-id that is unused.


Jon

TJ Kelly Mon, 12/08/2008 - 14:14
User Badges:

Jon,


Thanks for your help. This will work.


Tom

Actions

This Discussion