I have probably been staring at this too long and I am therefore missing something.
I have a requirement for a VPN tunnel to another vendor, but this tunnel is only going to allow for three internal LAN hosts to have access in to the vendor's network. Additionally, the subnets overlap, so those three hosts need to be NATed Not too terribly hard, right? Well, I did manage to get it working, however now the three LAN hosts are ALWAYS being NATed and therefore can't get to the internet.
Basically, I am trying to have it NAT to these specific IP's only when the packets are coming from these three hosts and are destined to the vendor's networks (over the VPN tunnel). For all other communication to the outside, I want it to NAT like any other hosts on the local LAN subnet.
The LAN is : 172.16.50.0/24 and the hosts are .90,.206, and .214
The NAT is: 10.224.1.25 through .26
I went about and created a Network Objects for the NAT'ed IP's for each of the three hosts: HostA_NAT, HostB_NAT, HostC_NAT
I created Network Objects for the LAN IP's for each of the three hosts. In doing so, I selected "Add Automatic Translation Rules" and selected the Network Object for the NAT'ed IP that correspondes. So for HostA, I selected "HostA_NAT" and so on.
I also created the ACL from the source address of the NATed IP's to the vendor's networks.
Now, the result is that the vendor can communicate to these hosts, and these hosts can communicate back, but these hosts cannot communicate to out to the internet.
I know I must be missing something simple here, and I suspect it has to do with the static nat setup. However, I am at a loss as to where to look.
I would personally like to see the NAT configurations in CLI format.
I presume that you have now configured basically Static NAT with the Network Object NAT configurations. This means that this NAT will be used for any destination address behind the "outside" interface and therefore its causing problems for your Internet traffic too.
So the NAT configurations should instead look something like this
Using the above configuration would mean that the NAT for the L2L VPN connection would only be applied to these 3 hosts when the destination network was the subnet configured under REMOTE-LAN.
Notice that the Real and Mapped source addresses are mapped between eachother in the order they are entered inside the "object-group". You have the option ofcourse creating an "object network" or "object-group network" for each host separately and pair them that way. You would also need 3 NAT configurations to do all them that way.
Login to the FXOS chassis manager.
Direct your browser to https://hostname/, and log-in using the user-name and password.
Go to Help > About and check the current version:
Check the current version availa...
We have configured the outside and inside Interface with official ipv6 adresses, set a default route on outside Interface to our router, we also have definied a rule , which also gets hits, to permit tcp from inside Interface to any6.
In Syslog I also se...