Site-to-site VPN issue: Passing public IP through IPSEC

[cchristodoulou]

Hi all,

I need to create a site-to-site VPN tunnel using IPSEC established over the Internet between two offices. The offices belong to two different companies.

I was given a range of 16 public IP addresses. One of these IPs is used on the ISPs router and it is the next-hop for my router. Another IP from the range is used on my router?s external interface ( which is a Cisco 851) and it is also my site's VPN endpoint. So far so good...

Here is my problem: The source IP for the encrypted traffic, is a public address from within the 16 public IPs I have (not the one on my router's interface). The actual application that needs to send the encrypted data is a server in my LAN, and it has a private IP. The other site, expects to receive the encrypted data however, from the public IP. I used NAT between the private IP address of the server and its public IP, but no data passes through the tunnel. By the way, the tunnel between the two end points establishes with no problem. The problem is that the source of my encrypted data is the public IP and I do not know how to route it through the tunnel. I am attaching the configuration of my router.

Any help is appreciated.

[Kamal Malhotra]

Hi,

Please try to configure a static instead of port forwarding :

ip nat inside source static 192.168.0.160 AA.AA.AA.AB

HTH,

Please rate if it helps,

Regards,

Kamal

[kaachary · Accepted solution]

The access-list "natted-traffic" should say :

ip access-list extended natted-traffic

deny ip host 192.168.0.160 host BB.BB.BB.BD

deny ip host 192.168.0.160 host BB.BB.BB.BE

exit

Hope this helps.

-Kanishka

[Kamal Malhotra]

But we need to NAT the traffic rather than nat bypass.

[kaachary]

That is what this will do !

You have to first deny it from patting, so that its statically natted.

-Kanishka

[cchristodoulou]

kmalhotr and kaachary,

Thank you for the response but unfortunately neither suggestion solved my problem. I have run the VPN TEST through the SDM and it showed the NAT test as successful, along with everything else, except the peer connectivity. As I said before the VPN tunnel is established but cannot pass traffic through it. SDM also reported the following:

*******************************************

Failure Reason(s): The following source(s) are routed through the crypto map interface. 1) AA.AA.AA.AB

Recommended Action(s): Go to 'Configure->Routing' and correct the routing table

*******************************************

If I understand this correctly, I need to tell the traffic originating from IP AA.AA.AA.AB to be forwarded through my VPN endpoint with IP AA.AA.AA.AA. How can I do this though, since IP AA.AA.AA.AB is not configured on any interface, it is in the same IP range as AA.AA.AA.AA and it is only used for staticNATing an internal private IP (192.168.0.160).

[kaachary]

I don't think its the problem with the routing. Can you please post the output of "sh cry ipsec sa" and "sh ip nat trans" when you try to initiate some traffic.

-Kanishka

[cchristodoulou]

Kanishka,

It turns out you were right! I made the changes remotely last night and then tried to test my tunnel through the SDM. SDM gave an error. I kept the changes however and today I tried the tunnel by starting my actual application... it worked like a charm.

My access-list now look like below:

ip access-list extended natted-traffic

deny ip host AA.AA.AA.AB host BB.BB.BB.BD

deny ip host AA.AA.AA.AB host BB.BB.BB.BE

deny ip 192.168.0.0 0.0.0.255 host BB.BB.BB.BD

deny ip 192.168.0.0 0.0.0.255 host BB.BB.BB.BE

permit ip 192.168.0.0 0.0.0.255 any

ip access-list extended vpn-control-list

permit ip host AA.AA.AA.AB host BB.BB.BB.BD

permit ip host AA.AA.AA.AB host BB.BB.BB.BE

permit ip host 192.168.0.160 host BB.BB.BB.BD

!

Probably I can remove a couple of lines out of there, something to try tomorrow!

Thank you for the help.