Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Attention: The Community will be in read-only mode on 12/14/2017 from 12:00 am pacific to 11:30 am.

During this time you will only be able to see content. Other interactions such as posting, replying to questions, or marking content as helpful will be disabled for few hours.

We apologize for the inconvenience while we perform important updates to the Community.

New Member

831 VPN nat and pat

I was able to do this with the PIX 6(3).3 but I am having a hard time getting it to work on a router.

Here is what I need to do.


E1(WAN)= x.x.x.x

I need to NAT the address to only when going through the IPsec tunnel to All other traffic must go out as the

On the PIX it was simple to do policy nat.

static (inside,outside) access-list VPN

Access-list VPN permit ip

Anyone have any ideas, hwo to get this done. I have tried using routemaps, but I am unable to then get the traffic NATed.



New Member

Re: 831 VPN nat and pat

Hi Anthony,

very interesting. I have not tried it on a router, sorry.

But I have a question to you because not many - I guess - are using policy nat and then putting the natted traffic into ipsec.

It worked in my config too, but I ran into one further problem: I was not able to connect to the pix using its inside IP let's say for ssh or telnet through the vpn-tunnel. I used management-access inside and tried ssh through the vpn-tunnel on "". I saw a xlate onto "" (.1 = IP of Pix) but no connection.

If I worked it out without nat, it worked. Do you have a solution?

Hope you apologize my side-question.


New Member

Re: 831 VPN nat and pat


No, I dont have an answer for that. We normally do out of band access to these devices (modem) in case of a failure durning a config change or internet outage.

Just to give you an idea. We have a VPN set between a 3005 and a 501. I am unable to SSH, telnet or PDM to it from the remote side of the tunnel. I am however able to access it from our Corporate firewall. (I allowed that IP to the PIX just incase.) From my understanding, this cant be done from inside the tunnel even with out NATting the traffic. I may be completly wrong though.

New Member

Re: 831 VPN nat and pat

Route maps are one of the ways this can be achieved.

Basically you define a loopback interface on the router and route VPN traffic via it. For the loopback you apply a "nat inside" to it, for E0 you do not apply a nat command and for E1 you apply "nat outside". Obivously you also need to define the actual NAT translation that will occur via the usual means. eg ip nat inside source .....

Once this is done you apply policy based routing (route maps) to the E0 and E1 interfaces that match the VPN traffic and set the next hop as being via the loopback interface. All other traffic goes directly from E0 to E1.

The following is a good starting point however note it does essentially the opposite of what you want. ie No NAT for the VPN and NAT otherwise. The basic principles however are quite similar.

New Member

Re: 831 VPN nat and pat

Very interesting solution for the starting problem of this thread!!


New Member

Re: 831 VPN nat and pat

I was very glad to find someone else trying to accomplish this. We've been trying to get VPN users into the corporate LAN via a 3005 and then be able to send them and the local networks over a pix-to-pix ipsec vpn to a host at their client's location. We've been able to get it to work, but now that we try to hide everyone at the host (and 3005 vpn clients) behind a pat address towards the client server, we're having trouble getting the pix to pix vpn establish. In the ACL that you are using to define interesting traffic for the VPN do you use the internal address or the policy NAT address? We've tried both and neither seems to work.

Thanks in advance for any advice.

Chris Smith

CreatePlease to create content