The Following config will do Policy NAT on a L2L tunnel, but I want to
PAT from one IP. So for Example instead of NATing 172.16.5.0, I want to PAT 172.16.5.10 for all inside clients before crossing tunnel. Can this be done?? How? I tried setting the static to 172.16.5.10 but get errors about overlapping global........
In order to configure Policy NAT for VPN traffic, for example, to change the source address, refer to this configuration example. In this example, the internel network is 10.10.1.0/24.
- Create an access-list for Policy NAT with real source and a destination IP address.
access-list POLICYNAT extended permit ip 10.10.1.0 255.255.255.0 host 172.16.1.1
access-list POLICYNAT extended permit ip 10.10.1.0 255.255.255.0 184.108.40.206 255.255.255.0
- Create a static command that states that when source is 10.10.1.0 and destination is 172.16.1.1 or 220.127.116.11, change it to 172.16.5.0
static (inside,outside) 172.16.5.0 access-list POLICYNAT
- Create a crypto access-list with the source as the new IP address defined in Policy NAT, for example, 172.16.5.0.
access-list VPN extended permit ip 172.16.5.0 255.255.255.0 host 172.16.1.1
access-list VPN extended permit ip 172.16.5.0 255.255.255.0 18.104.22.168 255.255.255.0
- Apply the crypto access-list to crypto map.
crypto map VPN 10 match address VPN