Solved: s2s vpn along with pat

SANTHOSHKUMAR SARAVANAN · ‎08-03-2010

Hi all ,

I have to establish s2s vpn to my client networks

my internal network 192.168.1.x 255.255.252.0 would require access to entire 10.0.0.0/8 client network via s2s vpn , But client does nt want us to send real IP source to access their resource , they ask us to PAT entire IP subnet to IP 192.16.x.x for accessing 10.0.0.0/8 .

Similarly whether this setup would have realibilty to S2S connection , kindly help in coomands , Thank you

Nagaraja Thanthry · ‎08-03-2010

Hello,

If I understand you right, you are interested in seeing if the internal

clients can use a public IP when they go to the remote vpn subnet. As long

as that public IP is not the interface IP (VPN end point ip address), it

should be fine.

As far as your question about reliability is concerned, could you please

elaborate on what do you mean by reliability? As it is, it is a general IP

communication and it will not affect any other system (unless there is a

conflicting configuration).

Hope this helps.

Regards,

NT

View solution in original post

Nagaraja Thanthry · ‎08-03-2010

Hello,

You can use policy nat to achieve what you are looking for:

access-list pnat permit ip 192.168.1.0 255.255.252.0 10.0.0.0 255.0.0.0

global (outside) 100 192.16.0.0 netmask 255.255.252.0

nat (inside) 100 access-list pnat

access-list cryptomap permit ip 192.16.0.0 255.255.252.0 10.0.0.0 255.0.0.0

This will map the 192.168.1.0 subnet to 192.16.0.0 subnet when accessing

10.0.0.0/8 network.

Hope this helps.

Regards,

NT

SANTHOSHKUMAR SARAVANAN · ‎08-03-2010

Hi Raj ,

Thanx so much for response , whether ip can use public IP address as PAT IP, so that PAT IP traffic would be encrypted inside tunnel , similarly let us know this kind of setup would have network relability . Thank you ..

Nagaraja Thanthry · ‎08-03-2010

Hello,

If I understand you right, you are interested in seeing if the internal

clients can use a public IP when they go to the remote vpn subnet. As long

as that public IP is not the interface IP (VPN end point ip address), it

should be fine.

As far as your question about reliability is concerned, could you please

elaborate on what do you mean by reliability? As it is, it is a general IP

communication and it will not affect any other system (unless there is a

conflicting configuration).

Hope this helps.

Regards,

NT