Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Lan to Lan VPN without nat exempt

Hi I am trying to create a lan to lan vpn with a company and i have the option of using a 2801 router or an asa5505  on my end, my local network have an ip /16 and the company will not allow RFC1918 address through the vpn tunnel and we will need to use a public address and use nat through the tunnel but im am not sure on the configurations and need a little help I did a diagram to illustrate please see attached.

Cisco Employee

Hi Roberto,You can use these

Hi Roberto,

You can use these links for L2L VPN configuration on routers and ASA.
For hiding your private IP , you will need to use PAT to translate all your internal networks into interface's public IP.
Lastly, you will use your interface's public IP in crypto access-list on ASA and router.

Dinesh Moudgil

P.S Please rate helpful posts.


New Member

Hi Dinesh I have setup l2l

Hi Dinesh I have setup l2l vpns before but usually the lan addresses are exempted on both ends and they work just fine but im notr sure ho to configure the outside interface to nat through the tunnel as well  i will post some output from a simulated network 

New Member

here is my asa output  i

here is my asa output  i tried this config but didnt work


Result of the command: "sh run"

: Saved
ASA Version 8.0(4)
hostname SITE-B
enable password 8Ry2YjIyt7RRXU24 encrypted
passwd 2KFQnbNIdI.2KYOU encrypted
name site-a-network
interface Vlan1
 no nameif
 no security-level
 no ip address
interface Vlan100
 nameif inside
 security-level 100
 ip address
interface Vlan200
 nameif outside
 security-level 0
 ip address
interface Ethernet0/0
 switchport access vlan 200
interface Ethernet0/1
 switchport access vlan 100
interface Ethernet0/2
 switchport access vlan 100
interface Ethernet0/3
 switchport access vlan 100
interface Ethernet0/4
 switchport access vlan 100
interface Ethernet0/5
 switchport access vlan 100
interface Ethernet0/6
 switchport access vlan 100
interface Ethernet0/7
 switchport access vlan 100
ftp mode passive
access-list outside_1_cryptomap extended permit ip interface outside site-a-network
pager lines 24
mtu inside 1500
mtu outside 1500
icmp unreachable rate-limit 1 burst-size 1
asdm image disk0:/asdm-613.bin
no asdm history enable
arp timeout 14400
global (outside) 10 interface
nat (inside) 10
route outside 1
timeout xlate 3:00:00
timeout conn 1:00:00 half-closed 0:10:00 udp 0:02:00 icmp 0:00:02
timeout sunrpc 0:10:00 h323 0:05:00 h225 1:00:00 mgcp 0:05:00 mgcp-pat 0:05:00
timeout sip 0:30:00 sip_media 0:02:00 sip-invite 0:03:00 sip-disconnect 0:02:00
timeout sip-provisional-media 0:02:00 uauth 0:05:00 absolute
dynamic-access-policy-record DfltAccessPolicy
http server enable
http inside
no snmp-server location
no snmp-server contact
snmp-server enable traps snmp authentication linkup linkdown coldstart
crypto ipsec transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto ipsec security-association lifetime seconds 28800
crypto ipsec security-association lifetime kilobytes 4608000
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set pfs
crypto map outside_map 1 set peer
crypto map outside_map 1 set transform-set ESP-3DES-SHA
crypto map outside_map 1 set security-association lifetime seconds 28800
crypto map outside_map 1 set security-association lifetime kilobytes 4608000
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400
telnet timeout 5
ssh timeout 5
console timeout 0
dhcpd dns
dhcpd domain
dhcpd address inside
dhcpd enable inside

threat-detection basic-threat
threat-detection statistics access-list
no threat-detection statistics tcp-intercept
tunnel-group type ipsec-l2l
tunnel-group ipsec-attributes
 pre-shared-key *
class-map inspection_default
 match default-inspection-traffic
policy-map type inspect dns preset_dns_map
  message-length maximum 512
policy-map global_policy
 class inspection_default
  inspect dns preset_dns_map
  inspect ftp
  inspect h323 h225
  inspect h323 ras
  inspect netbios
  inspect rsh
  inspect rtsp
  inspect skinny  
  inspect esmtp
  inspect sqlnet
  inspect sunrpc
  inspect tftp
  inspect sip  
  inspect xdmcp
  inspect icmp
service-policy global_policy global
prompt hostname context
: end


New Member

after much thinking and

after much thinking and reading i figured it out i needed to create access lists to match the traffic that will be going through the tunnel and then create a nat rule natting the traffic in the accesslist to a public ip address

CreatePlease login to create content