NAT inside of a VPN tunnel

[dmurphy]

I have a VPN NAT problem kind of any that I hope that some one can help me with. I can?t believe I?m the only one that has ever had this issue.

I?m using 10.1.101.0 /24 on my inside network and I need to connect to a vendor through a VPN tunnel from my PIX 515 firewall across the internet, here the catch they require a static 172.27.222.0/24 address for each of my clients that uses their software for it to work. I?ve been doing this connection through a point to point connection before now, so it hasn?t been a problem.

I guess the question is, how can I get my 10 network NATed to a 172 network inside a VPN tunnel. I hope some can help. Can this even be done?

[Mrkaprino]

I think you need to nat than route the data through the VPN. Please check out the faq

http://www.cisco.com/en/US/products/ps6120/products_tech_note09186a00807e0aca.shtml

[Mrkaprino]

This might be a better example webs link.

I think you need to setup a nat access list rule, then a access list rule for the VPN, then apply the access list VPN to the VPN tunnel.

Let me know how it goes.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00805a87f7.shtml

[jmia]

Why not try the following:

Basically, you'll be NAT'ing your private LAN address 10.1.101.0/24 to a global IP (213.249.300.200), the crpto match address statement will trigger traffic via the tunnel originating from 213.249.300.200 address, as far as your customer is concerned they will see that your traffic is coming from IP 213.249.300.200 rather then your LAN ip 10.1.101.0/24.

I am presuming that your customer side addrss is 172.27.222.0/24 ?

Any other traffic from your LAN side will be translated to your public IP address assigned to your PIX outside interface i.e.

global (outside) 1 interface

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

The 81.155.x.x (in this example), will be the peer IP address of your customer firewall.

access-list nat_to_customer permit ip 10.1.101.0 255.255.255.0 172.27.222.0 255.255.255.0

access-list crypto_map_customer permit ip host 213.249.300.200 172.27.222.0 255.255.255.0

ip address outside 213.249.300.100 255.255.255.248

ip address inside 10.1.101.x 255.255.255.0

global (outside) 2 213.249.300.200

global (outside) 1 interface

nat (inside) 2 access-list nat_to_customer 0 0

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 213.249.300.150 1

sysopt connection permit-ipsec

crypto ipsec transform-set esp-3des esp-md5-hmac

crypto map testmap 1 ipsec-isakmp

crypto map testmap 1 match address crypto_map_customer

crypto map testmap 1 set peer 81.155.x.x

crypto map testmap 1 set transform-set

crypto map testmap interface outside

isakmp enable outside

isakmp key address 81.155.x.x netmask 255.255.255.255

isakmp identity address

isakmp policy 10 authentication pre-share

isakmp policy 10 encryption 3des

isakmp policy 10 hash md5

isakmp policy 10 group 2

isakmp policy 10 lifetime 3600

I hope that I have understood your question correctly?

If it helps please rate posts!

Jay

[Kamal Malhotra]

Hi,

I beleive what you need is a policy NAT. E.g. their network is 192,168.1.0/24, it would look like :

access-list nat_to_customer permit ip 10.1.101.0 255.255.255.0 192.168.1.0 255.255.255.0

static (inside,outside) 172.27.222.0 access-list nat_to_customer mask 255.255.255.0

access-list crypto_map_customer permit ip 172.27.222.0 255.255.255.0 192.168.1.0 255.255.255.0

Rest of the configuration would be like any other regular VPN. There is another catch. Please make sure that there is no nat bypass configuration for the traffic from 10.1.101.0 255.255.255.0 to 192.168.1.0 255.255.255.0 as if it is there then the policy NAT won't work.

Please let me know if you need anything else. Please do rate if it helps.

Regards,

Kamal

[Kamal Malhotra]

Just to add, with this method, the last octet of your IP addresses will remain the same. E.g. 10.1.101.7 will be translated to 172.27.222.7.

Please also make sure than you are running 6.3.4 or higher version on the PIX.

HTH,

Kamal

[gothamprojects]

Hi There,

I have a similar situation, where I've configured an ipsec tunnel as shown below to a vendor, which I can bring up by pinging the remote network. However, the vendor requires that this tunnel be NAT'd behind our external IP. Can I use the method above to NAT traffic to this tunnel with the outside interface IP? Simply removing the entry from the nonat access-list prevents the tunnel from coming up, so I suspect I need an explicit NAT statement like the static shown above? (The access-list vpn_in is assigned to the outside interface).

(Vendor's IP ranges xxx-ed to protect the innocent)

Kind Regards.

access-list nonat permit ip host 10.10.10.12 xxx.xxx.xxx.xxx 255.255.255.0

access-list vpn_in permit ip xxx.xxx.xxx.xxx 255.255.255.0 host 10.10.10.12

access-list vendor permit ip host 10.10.10.12 xxx.xxx.xxx.xxx 255.255.255.0

global (outside) 1 interface

nat (inside) 0 access-list nonat

nat (inside) 1 0.0.0.0 0.0.0.0 0 0

crypto map vpn 11 ipsec-isakmp

crypto map vpn 11 match address vendor

crypto map vpn 11 set peer xxx.xxx.xxx.xxx

crypto map vpn 11 set transform-set desmd5

[Kamal Malhotra]

Hi gothamprojects,

If your tunnel comes up with the current config, then you need to make changes on both the ends for the NAT thing to work. If you make changes just on your device then the other end might not accept the connection.

HTH,

Please do rate of it helps.

Regards,

Kamal

[gothamprojects]

Hi Kamal thanks for the speedy reply,

For the purposes of this disucssion can we assume that the other end is correctly configured for this NAT situation?

What would I need to do to masquerade local ip addresses behind the outside interface address? Currently only the one host 10.10.10.12 needs to use the tunnel. I'd prefer to use an access-list for hosts that need to be NAT'd pre-tunnel so I can add further hosts in the future.

GP.

[Kamal Malhotra]

Hi,

Is the 10.10.10.12 a NATed IP or the physical IP? If it is NATed then we can assume that the other end is correctly configured. You can use the commands similar to what I had posted earlier to get it done.

HTH,

Please do rate if it helps.

Regards,

Kamal

[dmurphy]

There have been many great answers, by I think I'm going to try this one. It makes since to me.

Thanks to everyone for the help. I'll try this out and update everyone on how it works out.

[dmurphy]

I have question that comes to mind on this configuration, would I set the match statment in the crypto map to the NATed address (172.27.222.0) or the local 10.1.101.0?

[Kamal Malhotra]

The NATed address.

[dmurphy]

You know I must be blind. I didn't see that you had actually answer that question the first time. Once again thank you

[Kamal Malhotra]

Hi,

No problems :-)

Please rate the posts if you think those were helpful.

Regards,

Kamal