Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

s2s vpn along with pat

Hi all ,

              I have to establish s2s vpn to my client networks

my internal network 192.168.1.x 255.255.252.0 would require access to entire 10.0.0.0/8 client network via s2s vpn , But client does nt want us to send real IP source to access their resource , they ask us to PAT entire IP subnet to  IP 192.16.x.x for accessing 10.0.0.0/8 .

Similarly whether this setup would have realibilty to S2S connection , kindly help in coomands , Thank you

1 ACCEPTED SOLUTION

Accepted Solutions
Cisco Employee

Re: s2s vpn along with pat

Hello,

If I understand you right, you are interested in seeing if the internal

clients can use a public IP when they go to the remote vpn subnet. As long

as that public IP is not the interface IP (VPN end point ip address), it

should be fine.

As far as your question about reliability is concerned, could you please

elaborate on what do you mean by reliability? As it is, it is a general IP

communication and it will not affect any other system (unless there is a

conflicting configuration).

Hope this helps.

Regards,

NT

3 REPLIES
Cisco Employee

Re: s2s vpn along with pat

Hello,

You can use policy nat to achieve what you are looking for:

access-list pnat permit ip 192.168.1.0 255.255.252.0 10.0.0.0 255.0.0.0

global (outside) 100 192.16.0.0 netmask 255.255.252.0

nat (inside) 100 access-list pnat

access-list cryptomap permit ip 192.16.0.0 255.255.252.0 10.0.0.0 255.0.0.0

This will map the 192.168.1.0 subnet to 192.16.0.0 subnet when accessing

10.0.0.0/8 network.

Hope this helps.

Regards,

NT

Re: s2s vpn along with pat

Hi Raj ,

                Thanx so much for response ,  whether ip can use public IP address as PAT IP, so that PAT IP traffic would be encrypted inside tunnel , similarly let us know this kind of setup would have network relability . Thank you ..

Cisco Employee

Re: s2s vpn along with pat

Hello,

If I understand you right, you are interested in seeing if the internal

clients can use a public IP when they go to the remote vpn subnet. As long

as that public IP is not the interface IP (VPN end point ip address), it

should be fine.

As far as your question about reliability is concerned, could you please

elaborate on what do you mean by reliability? As it is, it is a general IP

communication and it will not affect any other system (unless there is a

conflicting configuration).

Hope this helps.

Regards,

NT

168
Views
0
Helpful
3
Replies