NAT for VPN with only 1 eth-if

[jc]

We are running a Router behind a NAT-Firewall. The Router has 1 eth-if and several BRI / Ser.

There is a private IP-Addr. on the eth-if.

I would like to do a VPN with a customer where all Packets seem to be comming from one public IP which belongs to me.

I though of something like

ip nat inside source list xxx interface Loopback1 overload

with lo1 being one of my public IPs.

Problem is:

Where to put the IP NAT INSIDE and OUTSIDE ?!?!?

The Traffic is running over the eth-if ONLY !

And ideas ?

[lisa.hall]

You’ll probably have to create sub-interfaces but (not fully understanding the topology) I don’t think you’ll get the firewalling/security you want without the physical interfaces. You should work with TAC to be sure you set this up securely.