Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
New Member

ip nat with site to site vpn

hi all,

i am using cisco 1941 sec-k9 router with leased line internet.

i am configuring the port forwarding for my database and my email ports for webaccess.

and also i am configuring the cisco site to site vpn with asa 5505 .

my site to site vpn is fine and i am able to reach bith sides.

but the issue is i am not able to communicate the database and email ports through site to site vpn.

but if i remove the port forwarding i am able to communicate .

before i was using the same kind of setup in1841 . but for me it looks strange.

is there any new changes in 1941.

my nat config,

ip nat inside source static tcp 192.168.0.4 4890 x.x.x.x 4890 extendable

ip nat inside source static tcp 192.168.0.4 4891 x.x.x.x 4891 extendable

ip nat inside source static tcp 192.168.0.4 5555 x.x.x.x 5555 extendable

ip nat inside source static tcp 192.168.0.2 25 y.y.y.y 25 extendable

ip nat inside source static tcp 192.168.0.2 110 y.y.y.y 110 extendable

ip nat inside source static tcp 192.168.0.2 143 y.y.y.y 143 extendable

ip nat inside source static tcp 192.168.0.2 443 y.y.y.y 443 extendable

and my site to site proxy acl,

ip access-list extended IPSEC-HK

permit ip 192.168.0.0 0.0.0.255 10.8.9.0 0.0.0.255

access-list 101 deny   ip 192.168.0.0 0.0.0.255 10.8.9.0 0.0.0.255

thanks

cyril

1 REPLY
Super Bronze

Re: ip nat with site to site vpn

Hi,

As always I'm gonna state that Router VPN/NAT configurations aint my "speciality"

To me it seems that this problem is somehow due to the NAT.

On the firewall side im used to the situation that NAT0 overrides many other NAT configurations. In this case it seems your problem is that the port forwarding configurations override your VPNs NAT configurations?

Wonder if you could add that public IP address to the L2L VPN tunnel (with destination network 10.8.9.0/24) and try the connections (Mirror config on the ASA5505 side too ofcourse)? This way the hosts at ASA5505 end would contact straight the public IP address.

- Jouni

550
Views
0
Helpful
1
Replies
CreatePlease to create content