Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

NATting both ways

I have a 2811s doing many VPNs to partners and clients. These routers are on my "VPN" network off a PIX 525. I use static routes on the PIX to get the traffic from my networks to the appropriate router and then down the VPN. This has been the setup for years here. It works well and is predictable.

All the VPNs are built using crypto maps. We use a combination of dynamic and static NATs (depending on connection direction) to a public address range we own specifically for these VPN NATs. Our partners and clients also use public address in the VPNs so we never have private range conflicts. We are using ip nat inside and ip nat outside on our inside and outside identified interfaces.

Recently, this model broke down. I knew this would eventually show its ugly head. We have a client that will access a machine behind our pix over the internet from a public source address (let's say We also have a machine that needs to access this same address ( over a VPN. As all the routing takes place on the PIX, if I route to a VPN router, then the over-the-internet connections no longer work (their SYN packet comes over the internet, but my reply SYN-ACK routes to the VPN tunnel).

My solution is to use NAT. Instead of our opening connections to, we would open connections to a private address (let's say that would route to the VPN router and it would then NAT it to and send it down the tunnel. So I'd basically have two NATs happening on this router. One NAT from my source private to my source public and another NAT from my destination private ( to their destination public (

Since I'm using ip nat inside on my inside interface and ip nat outside on my outside interface, is this possible? Should I use ip nat outside source static command?

Any help would be greatly appreciated.


Re: NATting both ways

NATting both ways may not help you. Check if you have configured Hairpinning properly on the PIX. Following link may help you