nat inside source static AND/OR inside source overload?

[GRAEME DANIELSON]

On an 837 IOS 12.4 I want to nat the inside source depending on the destination.

Destination 1

Internet with normal PAT overload (also with static ports for incoming smtp and web)

So far so good.

Destination 2

IPsec tunnel. Devices on the remote end of the IPsec tunnel need to also initiate connections in to the local devices.

I can get Destination 2 working with a nat inside source route-map and nat pool but of course as it's a dynamic translation the remote tunnel devices can't initiate connections in. So I need a static nat for Destination 2?

A network static for tunnelled traffic does the trick in both directions nicely. But it NATs the inside sources for ALL destinations... not so nice.

I think I need a feature like a network static but with route-map selection for fine-grained control. Does such a feature exist?

I can't see a solution for this. Can someone prove me wrong please?!

TIA

[atif.awan]

Actually such a feature does exist and there is a solution for this.

http://www.cisco.com/en/US/products/sw/iosswrel/ps1839/products_feature_guide09186a0080087bac.html

I have actually done something quite similar for one of my clients. It did require some tweaks but worked out quite well.

[GRAEME DANIELSON]

Yes, I had already seen this feature; it is for individual static translations. The problem is I need to translate a subnet so would need this as a NETWORK static. The document specifically states...

"Network static support is not included in this feature."

Thankyou for your response.

[atif.awan]

I had overlooked the network static requirement.