I have the need to NAT an inside address (DMZ acutally) to two different outside addresses- one outside address is just for internet access, the other one is a NATed address on a VPN L2L tunnel.
So I want 10.10.10.1 to translate to 192.168.1.1 if going through the L2L tunnel and destined to the 172.16.0.0 network (tunnel terminated on outside interface), but I want it to translate to my public address 18.104.22.168 if going out to internet (outside).
I've tried using access lists for the second VPN tunnel static entry but get a "duplicate static entry" message when entering the static command.
This is my scenario I tried:
I have my original "classic"
static (inside,outside) 22.214.171.124 10.1.1.1 netmask 255.255.255.255
Then for my L2L tunnel:
access_list L2L extended permit ip host 10.1.1.1 172.16.1.1
static (inside,outside) 192.168.1.1 access-list L2L
Then, I also put in my nat commands:
nat (dmz) 1 access-list NAT_L2L h
access-list NAT_L2L host 10.1.1.1 1 host 172.16.1.1
I have two questions:
1) Originally there was not a nat (dmz,outside) command, but statics for dmz-outside. I thought you always needed a "nat" command for an interface when translating.....
2) Proper configuration for translating same inside (or DMZ) address to two different outside IP addresses, dependent upon their destination.....