IPsec and NAT

Unanswered Question
Mar 6th, 2009
User Badges:


I have IPSec tunnel from remote location to central location( Cisco 7200). Problem is that remote location is different company and they use some of address range that we also use.

How can I configure NAT translation of their addresses to one address in my range on my router(central location)? If I put "ip nat inside" on interface toward internet I don't think it will work because original packet is encrypted (tunnel ends on loopback interface). And also I don't know if there is the way to put "ip nat inside" on IPSec tunel.

If anyone have idea how to solve this please help.



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
ggilbert Fri, 03/06/2009 - 06:33
User Badges:
  • Cisco Employee,

Antonio -

On your router & on the remote router, you can change the address to a different subnet using the route-map option.

Lets say your network is and the remote side network is the same as well. You want to change your network to and the remote side to

On your router,

a. Create an ACL

access-list 100 per ip

b. Create a route-map

route-map CRYPTONAT per 10

match ip add 100

c. Create a static NAT with route-map option

ip nat inside source static route-map CRYPTONAT

And you have to do this vice versa on the other end.

Let me know if this helps.



Antonio_1_2 Fri, 03/06/2009 - 06:52
User Badges:

Hi Gilbert,

Problem is that I have to do everything on my router (I don't administer the other side and they don't won't do change anything in their config).

Do I put "ip nat inside" on LAN interface and "ip nat outside" on WAN inteface or vice versa?



ggilbert Fri, 03/06/2009 - 07:38
User Badges:
  • Cisco Employee,

Hello Antonio,

You have to put "ip nat inside" on your LAN interface and "ip nat outside" on your WAN interface.

In this case, you have to write an ACL that matches the interesting traffic. If your network is and remote network is the same. You cant have the same network as the source on destination on an ACL for crypto. The packets will be routed internally.

Or you can add another router internally before the LAN segment of the 7200 and NAT your network to a different range.

Will that work for you?

Antonio_1_2 Fri, 03/06/2009 - 08:15
User Badges:

Thanks, It seems I will have to do that way.




This Discussion