I have probably been staring at this too long and I am therefore missing something.
I have a requirement for a VPN tunnel to another vendor, but this tunnel is only going to allow for three internal LAN hosts to have access in to the vendor's network. Additionally, the subnets overlap, so those three hosts need to be NATed Not too terribly hard, right? Well, I did manage to get it working, however now the three LAN hosts are ALWAYS being NATed and therefore can't get to the internet.
Basically, I am trying to have it NAT to these specific IP's only when the packets are coming from these three hosts and are destined to the vendor's networks (over the VPN tunnel). For all other communication to the outside, I want it to NAT like any other hosts on the local LAN subnet.
The LAN is : 172.16.50.0/24 and the hosts are .90,.206, and .214
The NAT is: 10.224.1.25 through .26
I went about and created a Network Objects for the NAT'ed IP's for each of the three hosts: HostA_NAT, HostB_NAT, HostC_NAT
I created Network Objects for the LAN IP's for each of the three hosts. In doing so, I selected "Add Automatic Translation Rules" and selected the Network Object for the NAT'ed IP that correspondes. So for HostA, I selected "HostA_NAT" and so on.
I also created the ACL from the source address of the NATed IP's to the vendor's networks.
Now, the result is that the vendor can communicate to these hosts, and these hosts can communicate back, but these hosts cannot communicate to out to the internet.
I know I must be missing something simple here, and I suspect it has to do with the static nat setup. However, I am at a loss as to where to look.