Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Configuring IPSec Tunnel in a PIX with 2 NAT

We are experience some problems, we try to configure the next topology:

LAN1===>Router===>LAN2====>PIX====>InternetRouter===>Internet

The issue its we try to establish a VPN-Site2Site between the Local PIX and other PIX in Internet, in this IPSec tunnel we have to put services for LAN1, and LAN2.

But by the address we use in the LAN2(Public IP address), the other end of the tunnel request we use NAT to establish the IPSEC tunnel, the problem begin when we detect that the PIX already had configured NAT to go out to Internet.

My question is, there is any possibility to configure 2 NATS in the PIX, 1 NAT is used to Internet, and the second one used only when the LAN1,LAN2 try to establish a IPSex tunnel.

We can`t used NAT 0 (exclude Internet NAT 1, because we need NAT 2 to reach the VPN tunnel).

1 REPLY
Silver

Re: Configuring IPSec Tunnel in a PIX with 2 NAT

You can configure multiple nats with pix - use multiple nat statements with associated global statements, but you cannot have multiple *overlapping* nats - I don't think there is a way to have 10.10.10.0/24 get natted to 1.2.3.4 for certain netblocks, and to 5.6.7.8 for others.

That said, you almost *always* need nat 0 for ipsec tunnels. Nat breaks a ton of protocols used intralan (ms windows networking, etc).

125
Views
0
Helpful
1
Replies
CreatePlease to create content