Site to Site VPN with NAT

Unanswered Question

I am having a problem setting up a L2L tunnel with a partner. I am using a ASA 5520 running 8.0.4.

Both sides of the tunnel are using the subnet 10.30.x.x/16. The network list on my side of the tunnel will have the nodes,, and I need to allow these four nodes thru the tunnel to communicate with the remote subnet 10.30.x.x/16. However, the 10.30.x.x/16 subnet also exists on my local network. How do I configure the tunnel to make this happen? Can I NAT before the tunnel? For example, could I route all traffic destined for this tunnel to the 172.16.32.x/24 subnet and when the ASA sees traffic destined for this subnet the ASA will perform the NAT and send it to the proper destination for this tunnel?

Would this config be the right way to go?

access-list PNAT1 extended permit ip

static (inside,outside) access-list PNAT1

access-list PNAT5 extended permit ip

static (inside,outside) access-list PNAT5

access-list PNAT10 extended permit ip

static (inside,outside) access-list PNAT10

access-list cryptoACL extended permit ip

access-list cryptoACL extended permit ip

access-list cryptoACL extended permit ip

With this config, I would route traffic destined for the 172.16.32.x/24 subnet to the inside interface of our ASA and the ASA would encrypt and NAT the traffic to the 10.30.x.x/16 subnet.

Please help,



  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


Firstly you need to figure out the NAT subnet that you want to use for both sides.

The fact that you have 10.30.x.x on both sides initialy you have a routing issue.

I would suggest a network based nat so:-

1) Site A 10.30.x.x = 172.1.x.x

2) Site B 10.30.x.x = 172.2.x.x

Then you nat it before you put the traffic into the tunnel - and your crypto list will just be your NAT subnets.


This Discussion