Small ASA/PIX question

[m-haddad]

Hello,

I have ISP--Outside_Router--ASA. THe subnet between the Outside_Router is private subnet 192.168.0.0/30. However, all my NAT/PAT I am using public IPs.

Now we need to setup VPN tunnel from PIX to remote office. How can I do that? I mean since i have private IP address on the outside interface of the PIX I won't be able to terminate the VPN tunnel on the private IP address. Any ideas?

Regards,

[m-haddad]

have ISP--Outside_Router--ASA. THe subnet between the Outside_Router and the PIX outside interface is private subnet 192.168.0.0/30. However, all my NAT/PAT I am using public IPs.

Now we need to setup VPN tunnel from PIX to remote office. How can I do that? I mean since i have private IP address on the outside interface of the PIX I won't be able to terminate the VPN tunnel on the private IP address. Any ideas?

[mgaysek]

You might be able to perform a nat for the outside interface of the PIX on the router. Generally, nat and VPNS do not play nice. Otherwise you may need to get additionaly public IP addresses from your ISP, so you can assign one to the outside interface of your pix.

[ecouto]

If you ISP is doing static NAT to the IP of the pix and you use only ESP in IPSec for encryption payload (dont use AH) will work. Just configure as normal crypto and put in the other peer the public IP (NATed by your ISP)

Emilio

[dprincipi]

I've been asking myself the same question.

As far as I know, there is no equivalent to:

"crypto map MYMAP local-address loopbackX"

on a PIX. (I've only worked with 6.3(5) code and below).

In fact, I "think" that you can't even configure a loopback interface on a PIX.

Also, as far as I know, you couldn't configure a secondary IP on a PIX interface (this secondary IP could have public addressing but still the issue would be how to make this public address to become the local-ID for the crypto map).

If you find the answer please post it here, it seems that many of us share the same question.

Regards;

Diego

[a.hajhamad]

m-haddad,

You can setup the R. with both IPSec VLAN & NAT. I'm using this at Cisco 877 R. which doint NAT & VPN and connected to ASA with private IPs.

But you need to exclude the traffic from your LAN to the IPSec VPN cliens from the NAT list.

Thanks

Abd Alqader