ASA nat for vpn client to a single vlan

[r.spiandorello]

Hi, on ASA vpn peer 8.2.(x), I need to translate the remote-access IP pool, with nat/global, only for sessions bound to a particular ASA vlan: how to ?

On nat sintax I can insert only the interfaces name but which interface for traffic coming from vpn remote client ?

thanks

rs

[Jennifer Halim]

Assuming that your outside interface is terminating the vpn client, then you would configure the following:

access-list vpn-nat permit ip

nat (outside) 5 access-list vpn-nat outside

global (that-internal-vlan-name) 5

Hope that helps.

[r.spiandorello]

Hi, for that about security levels, do we need the same level ?

Usually the outside is at a lower level than the other zone, but here we palce nat on outside and globla on the other zone

thank you in advance

greatings

rs

[Jennifer Halim]

Yes, because the outside interface has lower security level, we need to configure the "outside" keyword as specify earlier:

nat (outside) 5 access-list vpn-nat outside