Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Community Member

Site to Site VPN with Natting Internal IP address range?

This is our actual Internal LAN address: 10.40.120.0/26 (Internal Range) and I want to translate to

Translated address: 10.254.9.64.255.255.255.192(Internal)

Our remote local address is: 10.254.5.64 255.255.255.192(Remote site Internal Ip add range)

Based on above parameters I done this configuration

access-list outside_cryptomap permit ip 10.254.9.64 255.255.255.192 10.254.5.64 255.255.255.192
access-list policy-nat permit ip 10.40.120.0 255.255.255.192 10.254.5.64 255.255.255.192
static (inside,outside) 10.254.9.64 access-list policy-nat

I got all the Phase1 and Phase 2 parameters required and peer public ip add,

I had set up vpn using ASDM before but this scenario is new for me, all I am wondering is there anything I need to configure to succesfully setup VPN

2 ACCEPTED SOLUTIONS

Accepted Solutions
Cisco Employee

Site to Site VPN with Natting Internal IP address range?

If you are seeing TX increasing but not RX that means traffic is being sent to the remote end however there is no reply.

I would suggest that you check in with the remote VPN end to see where the problem is. Most likely it is issue on the remote end.

Cisco Employee

Site to Site VPN with Natting Internal IP address range?

Can you please remove the following:

static (inside,outside) 10.254.7.64 access-list policy-nat

and change it to:

nat (inside) 5 access-list policy-nat

global (outside) 5 10.254.7.64

Then "clear xlate" again.

9 REPLIES
Cisco Employee

Site to Site VPN with Natting Internal IP address range?

Both NAT and crypto ACL has been correctly configured.

Which phase is the VPN failing at? can you run some debugs and share the debug output?

Community Member

Site to Site VPN with Natting Internal IP address range?

Thank you so much Jenni, I will update you asap

Community Member

Site to Site VPN with Natting Internal IP address range?

Hi

Thanks a lot jenni done exactly the above and from the following link http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b37d0b.shtml

The VPN is up as we are able to see the interesting traffic but Tx= is increasing and Rx=0 ? dont know what is going wrong, moreover far site is only accepting RDP access from our site and I am not able to access it? I am wondering do i need to do any additional configuration apart from the above to get RDP access

Assistance appreciated guys please

Cisco Employee

Site to Site VPN with Natting Internal IP address range?

If you are seeing TX increasing but not RX that means traffic is being sent to the remote end however there is no reply.

I would suggest that you check in with the remote VPN end to see where the problem is. Most likely it is issue on the remote end.

Community Member

Site to Site VPN with Natting Internal IP address range?

Hi mate,

yeah issue on far site they arent allowing access to the port we are trying to access, and they made it up and we are good to g now,

One thing I am worried is only one IP add is able to access the resources, I mean i created an add range of 192.168.x.0/26, however only 192.168.x.3 one of our server is able to access the far site, havent got a clue

config is as folllows:

access-list pp-vpn extended permit ip 10.254.7.64 255.255.255.192 10.254.6.64 255.255.255.192

access-list policy-nat---- extended permit ip 192.168.x.0 255.255.255.192 10.254.6.64 255.255.255.192

static (inside,outside) 10.254.7.64 access-list policy-nat

crypto ipsec transform-set esp-aes256-sha esp-md5-hmac

crypto map outside_map 20 match address pp-vpn

crypto map outside_map 20 set peer 172.162.1.2

crypto map outside_map 20 set transform-set vpn1

crypto map outside_map interface outside

crypto isakmp identity address

crypto isakmp policy 65 encyptio

authentication pre-share         

encryption des

hash md5

group 2

lifetime 86400

tunnel type ipsec-l2l

tunnel-group 172.162.1.2 ipsec-attributes

pre-shared-key *

Thank you immensly for all your assitance

ven

Cisco Employee

Site to Site VPN with Natting Internal IP address range?

Did you "clear xlate" after making changes to the static NAT statement?

Also, do you have any access-list on the inside interface that might be blocking the access?

Community Member

Site to Site VPN with Natting Internal IP address range?

Hi Jenni I tried both of the above, but still it remains the same, no inside access rules as well.

Cisco Employee

Site to Site VPN with Natting Internal IP address range?

Can you please remove the following:

static (inside,outside) 10.254.7.64 access-list policy-nat

and change it to:

nat (inside) 5 access-list policy-nat

global (outside) 5 10.254.7.64

Then "clear xlate" again.

Community Member

Site to Site VPN with Natting Internal IP address range?

That did it. Spot on, thanks! Thanks a lot Jenni!

2350
Views
5
Helpful
9
Replies
CreatePlease to create content