08-03-2010 12:01 PM - edited 03-11-2019 11:20 AM
Hi all ,
I have to establish s2s vpn to my client networks
my internal network 192.168.1.x 255.255.252.0 would require access to entire 10.0.0.0/8 client network via s2s vpn , But client does nt want us to send real IP source to access their resource , they ask us to PAT entire IP subnet to IP 192.16.x.x for accessing 10.0.0.0/8 .
Similarly whether this setup would have realibilty to S2S connection , kindly help in coomands , Thank you
Solved! Go to Solution.
08-03-2010 01:06 PM
Hello,
If I understand you right, you are interested in seeing if the internal
clients can use a public IP when they go to the remote vpn subnet. As long
as that public IP is not the interface IP (VPN end point ip address), it
should be fine.
As far as your question about reliability is concerned, could you please
elaborate on what do you mean by reliability? As it is, it is a general IP
communication and it will not affect any other system (unless there is a
conflicting configuration).
Hope this helps.
Regards,
NT
08-03-2010 12:07 PM
Hello,
You can use policy nat to achieve what you are looking for:
access-list pnat permit ip 192.168.1.0 255.255.252.0 10.0.0.0 255.0.0.0
global (outside) 100 192.16.0.0 netmask 255.255.252.0
nat (inside) 100 access-list pnat
access-list cryptomap permit ip 192.16.0.0 255.255.252.0 10.0.0.0 255.0.0.0
This will map the 192.168.1.0 subnet to 192.16.0.0 subnet when accessing
10.0.0.0/8 network.
Hope this helps.
Regards,
NT
08-03-2010 12:14 PM
Hi Raj ,
Thanx so much for response , whether ip can use public IP address as PAT IP, so that PAT IP traffic would be encrypted inside tunnel , similarly let us know this kind of setup would have network relability . Thank you ..
08-03-2010 01:06 PM
Hello,
If I understand you right, you are interested in seeing if the internal
clients can use a public IP when they go to the remote vpn subnet. As long
as that public IP is not the interface IP (VPN end point ip address), it
should be fine.
As far as your question about reliability is concerned, could you please
elaborate on what do you mean by reliability? As it is, it is a general IP
communication and it will not affect any other system (unless there is a
conflicting configuration).
Hope this helps.
Regards,
NT
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide