IPSec tunnel with perticular NAT IP injection

Unanswered Question
Oct 3rd, 2009

I have to implement a Site to Site tunnel with one of our client they have provided me there vpn router ip with configurations and have asked me to connect the vpn using a particular private ip 172.16.16.1, where as my local LAN IP is 192.168.1.0/24.

Is there a way to implement a NAT on PIX 515e so that the complete scheme is natted in to the specified ip 172.16.16.1 while accessing this perticular tunnel.

If possible send me a pdm configuration link specifying the above configs

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
auraza Thu, 10/08/2009 - 11:02

NO PDM link that I know of. The gist of it is that you need to create nat/global pair on the PIX - a policy "PAT" (nat with acl). Then use the NAT'd IP as the source in the crypto acl to the remote network.

Example:

access-list natvpn permit ip 192.168.1.0 255.255.255.0 REMOTE_NETWORK_IP REMOTE_NETWORK_SUBNET

nat (inside) 10 access-list natvpn

global (outside) 10 172.16.16.1

access-list cryptoacl permit ip host 172.16.16.1 REMOTE_NETWORK_IP REMOTE_NETWORK_SUBNET

crypto map test 10 match address cryptoacl

Good luck.

Actions

This Discussion