NAT on 2 sub-interfaces on the same physical interface

[m.peran]

Hello,

I have a 1720 with an IPSEC IOS and only 1 fastethernet interface

I need to configure a VPN access.

I purpose to active NAT on 2 sub-interfaces on the same physical interface (ip nat inside / ip nat outside).

This design is it possible ?

This design decrease the performances or the security of this acces ?

Regards,

Michel.

[mhussein]

If you have a vlan-capable switch (e.g 2900XL, 3500XL) you can implement a "router-on-a-stick" design.

The idea is to setup sub-interfaces on the router with ISL or dot1q encapsulation on the router, and setup a trunk port on the switch.

As far as performance, the bottleneck would be the router's encryption throughput (I think it is less than 6Mbps for low end routers).

Security wise, you better off using ISL encapsulation on sub-interfaces.

HTH,

Mustafa