Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

Cisco IOS - Destination NAT within VPN tunnel to PIX/ASA


I am trying to configure a remote worker setup where users can be given a router which they connect to their home DSL network, which will then get an address by DHCP from their router and then create a point to point VPN back to an ASA or PIX at the HQ office. This is made more complex by the fact that the HQ LAN uses, as do most home DSL routers. The home worker router also needs to do DHCP on its internal interfaces and dynamic NAT, so that internal machines can still access the Internet outside of the tunnel.

The network map looks like this:

Home worker.png

I have sucessfully set up a dynamic VPN on the HQ PIX which allows the router to create a tunnel, and this works fine when connected to a DSL router with internal address range of, i.e. not overlapping with the HQ LAN.

I assume I need to do destination NAT on the home worker router and un-NAT on the PIX, but I cannot work out how to do this.

Any help appreciated, many thanks in advance


  • WAN Routing and Switching
Everyone's tags (5)
This widget could not be displayed.