LAN to LAN PAT/NAT on 3020 concentrator

[jstewart33]

I have a customer who wants to create a L2L tunnel, but says that they will only allow us to use up to three IP addresses. I've never had any other customers ask me to do it this way and I'm a little stumped as how I should make it work. I'm guessing some form of NAT/PAT should solve the issue for me. Could someone please steer me in the right direction.

Thanks!

[Farrukh Haroon]

I hope this document is a good start:

http://www.cisco.com/en/US/products/hw/vpndevc/ps2284/products_configuration_example09186a00801ae24c.shtml

Regards

Farrukh

[jstewart33]

Thank you for your response, but what I'm specifically looking for is being able to take a range of addresses on LAN and NAT to a single IP address. The customer has said that they will only allow up to three IP addresses. I have about 10 users that will need access to this L2L tunnel. So, I'm confused on how to accomplish this if they won't allow an entire subnet or my 10 IP addresses. Thanks in advance!

Jerrod

[Farrukh Haroon]

The Concentrator supports Dynamic NAT and PAT as well, but this is only for Outbound traffic. Have a look at:

http://www.cisco.com/en/US/docs/security/vpn3000/vpn3000_47/configuration/guide/polmgt.html#wp1639218

So its like a Walkie Talkie :)

A better approach would be to do the NAT/PAT on some device 'before' the Concentrator (If possible)

Regards

Farrukh

[jstewart33]

So basically I need to PAT or NAT overload on a router and then do a one to one Static NAT on the concentrator to be able to translate the one IP address the customer will allow. Have you ever seen problems with doing it this way? I'm curious as to why they are wanting to do it this way. Thank you very much.

[Farrukh Haroon · Accepted solution]

Yes you can use this approach for NAT. Perhaps they are 'over-cautious' with their security.

Regards

Farrukh