Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

I need a tunnel with NAT

Pix 515 6.3(3) has a pix to pix VPN, then, it has some vpn clients, all they are working fine, however, I need an aditional VPN to a VPN concentrator, and I have a problem, for security policies the partner which I need to connect does not permit my internal ip address, then I need to make NAT in order to get access to its network.

my internal is address 10.0.0.0, but need to make NAT to 172.16.1.0, But i do not know how to establish that nat and the access-lists.

can somebody help me ??

Martin C

5 REPLIES
New Member

Re: I need a tunnel with NAT

I am having a similar issue. I have a Cisco PIX 501 that already has several site-to-site connections established.

I need to establish an additional VPN to a device that already has a connecton that uses the IP addresses on my LAN interface. Is there a way to NAT my LAN so I can establish the VPN without putting another piece of hardware in place?

Thanks.

Hall of Fame Super Blue

Re: I need a tunnel with NAT

Hi Eric

The solution for Martin should also work for you.

HTH

Jon

Hall of Fame Super Blue

Re: I need a tunnel with NAT

Hi Martin

Let assume the remote partner network is 192.168.5.0 255.255.255.0

Also lets assume you only want to NAT your 10.0.0.0 addresses to 172.16.1.0 when you access your partner network.

access-list pnat permit ip 10.0.0.0 255.255.255.0 192.168.5.0 255.255.255.0

nat (inside) 2 access-list pnat

global (outside) 2 172.16.1.0 255.255.255.0

The above makes sure your 10.0.0.0 addresses are only natted to 172.16.1.0 when going to the partner network.

Now you setup your pix to VPN concentrator VPN in the same way as you have setup your pix to pix VPN. The major difference is on the crypto map access-lsit on your pix. You must refer to the Natted addresses ie.

access-list vpntraffic permit ip 172.16.1.0 255.255.255.0 192.168.5.0 255.255.255.0

HTH

Jon

New Member

Re: I need a tunnel with NAT

hey Jon, very useful that information,

thank you very very much.

regards

Martin C

Hall of Fame Super Blue

Re: I need a tunnel with NAT

No problem, glad to have helped.

Jon

124
Views
0
Helpful
5
Replies