Andrew - thanks, could you expand on your suggestion some more?

Naman - thanks, I'm not sure exactly how to apply that to this particular situation though? (As the head office subnet doesn't actually overlap with the 3rd party subnet but its some of our remote sites that do - I don't want to disrupt connectivity from head office to the remote sites though)

Ahhh I re-read your post and mu suggestion was for something different, but it still kinda holds true.

You could do a policy based NAT on the remote 3rd party into your network, but I would think a static 1 to 1 should do the trick.

But I would try seomthing like:-

static (outside,inside) x.x.x.x y.y.y.y netmask z.z.z.z

x.x.x.x = NAT address you would like that does NOT conflict on your network, like 192.168.1.1

y.y.y.y = real 3rd party IP address, like 10.1.1.1

z.z.z.z = network subnet mask, like a specific host 255.255.255.255

so the above would read:-

static (outside,inside) 192.168.1.1 10.1.1.1 netmask 255.255.255.255

If the remote 3rd party has multiple addresses you could do multiple static NAT statements or NAT the whole network range.

Then onces you have NATT'd the remote end - your VPN acl would just use a desintation IP address of the NATT'd IP not the real IP.

HTH>

You will need to double nat to get return traffic to your remote sites.