can you create a site to site tunnel behind a nat router using ASA

[carl_townshend]

Hi all

We have an ADSL router with the public IP on that, behind this we have an ASA firewall

Is it possible to create a site to site tunnel if I NAT the correct ports to the ASA ? if so what ports would I need to NAT, GRE / ISAKMP, UDP500 etc ?

cheers

[Karsten Iwen]

yes, that can be done. But first you should check if you can change the dsl-router to modem-mode where you have the public IP directly on the ASA. That would make things more easy.

If it is not possible, then you have to forward UDP/500 and UDP/4500 to the ASA to make IPSec work. Or for more flexibility in later changes configure the ASA as an "exposed host" on the DSL-router to which all traffic is forwarded that enters your network.


Sent from Cisco Technical Support iPad App

[carl_townshend]

by exposed host do you mean to do a direct nat for everything to the ASA ?

[Karsten Iwen]

yes, thats the term that is often used in smaller dsl-routers.

-- 
Don't stop after you've improved your network! Improve the world by lending money to the working poor:
http://www.kiva.org/invitedby/karsteni