About config dmz interface to be a part of ipsec vpn

[jj-zhou]

Hi netpro:

I read a case (Number:K19070059),it said there is 4 steps to configure dmz interface of pix to be a part of ipsec vpn.

1 Add a DMZ network in the VPN crypto access-list.

2 Add DMZ traffic in NAT 0 access-list.

3 Add DMZ traffic in the crypto access-list of the remote peer

4 Add the { nat ( DMZ ) 0 access-list nonat } command.

i am confused whether the step 2 overlap with step 4 , I think the step 2 is unuseful ,please help me ,thank you .

[anton_lva]

Hi!

[bhooker · Accepted solution]

step two is telling you to create an access-list that is to be used in step four.

for example:

step 2

access-list no-nat extended permit ip 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0

step 4

nat (DMZ) 0 access-list no-nat