Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

Site to Site VPN

I am just wondering whether following Site to Site VPN configuration scenario will work.

ASA--Internet RTR ---Internet Cloud --Internet RTR --ASA

Where ASA is outside interface will have the private IP Address. But internet Router at both side will have public ip address. And Internet router will be configured to NAT the public ip address to the ASA outside interface private ip address.

ASA will be configured site to site VPN with the peer IP address as public ip address of the internet routers.

will this setup work ?

thanks

3 REPLIES
Bronze

Re: Site to Site VPN

Hello,

I've never done this with ASA however it definitley works with IOS as your VPN endpoint. The only caveat is that you must use NAT not PAT (ie one to one address mapping).

Thanks

Silver

Re: Site to Site VPN

"The only caveat is that you must use NAT not PAT (ie one to one address mapping)."

That is not correct. You can do port-direct on the routers. In other

words, you can terminate VPN on the ASA

using the router's public ip address. For

example:

router's public IP: 4.2.2.2

ASA private IP: 192.168.1.2

on the Internet router:

interface f0/0

ip nat outside

ip address 4.2.2.2 255.255.255.0

interface f0/1

ip nat inside

ip address 192.168.1.1 255.255.255.0

ip nat inside source static udp 192.168.1.2 500 interface f0/0 500

ip nat inside source static esp 192.168.1.2 interface f0/0

Now you can terminate VPN on the ASA

using the router's public IP address as

the VPN termination endpoint.

Easy right?

New Member

Re: Site to Site VPN

Thanks a lot.

I just want to verify one more thing.

Lets say i have 2 public address. then i should be able port map one public address as you mention above and other one to NAT ( overload ) to provide the internet access the LAN user as below,

public IP : 4.2.2.2

4.2.2.3

say, mask : 255.255.255.248

ASA private IP: 192.168.1.2

on the Internet router:

interface f0/0

ip nat outside

ip address 4.2.2.2 255.255.255.248

interface f0/1

ip nat inside

ip address 192.168.1.1 255.255.255.0

ip nat inside source static udp 192.168.1.2 500 4.2.2.3 500

ip nat inside source static esp 192.168.1.2 4.2.2.3

ip nat inside source list 1 4.2.2.3 overload

access-list 1 permit 192.168.1.0 0.0.0.255

Thanks

191
Views
0
Helpful
3
Replies
CreatePlease to create content