I have the following challange and I can solve it partially only.
I need to connect two sites through ipsec L2L and apply some NAT back and forth.
The remote network is 10.1.0.0/24 my inside network is 192.168.1.0/24. The remote site cannot send traffic to 192.168.1.0 because this subnet is used on their network. So they are going to send the traffic to 10.10.1.1 for ftp and 10.10.1.2 for http. On my side I have 192.168.1.30 as ftp and 192.168.1.31 as http server. On my side when the traffic comes I have to translate the destination of 10.10.1.1 and 10.10.1.2 to 192.168.1.30 and 192.168.1.31 respectively.
I also have to send back some traffic to the remote site with source of 10.10.1.3 (from 192.168.1.30 and 192.168.1.31). So it means it is some kind of asymetric NAT. The question is whether it is possible or not? If possible how to approach it?
You can apply the overlapping networks strategy in your scenario, you will need policy nat. I've created a draft script bu if I have the time I will tested, however, it should be along those lines, look at the example link.
Thank you for your reply. I have also found that link but it seems that scenario is working only in case of the traffic going from my side (let say this is PAX-A) to the remote however I need the opposite. It is mentioned that if there is traffic coming back to the translated address (in my case 10.10.1.1, and .2) it will not reach the inside network. Do you know any other way to achieve this?
DocumentationCode download linksGoalRequirementLimitationsSupported ISR
and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationConfigure one of the connectivity
options to access the Cisco IMC from the n...
Firepower Threat Defense (NGFWv) on UCS E-series - Transparent Mode in
HA DocumentationCode download linksGoalRequirementLimitationsSupported
ISR and UCS-E ModelSupported ISRG2 and UCS-E Blades:Supported ISR4K and
UCS-E Blades:Step by Step ConfigurationCo...
Question I am currently unable to specify "crypto keyring" command when
configuring VPN connection on my cisco 2901 router. The following
licenses have been activated on my router :