NAT for a private IP

[Joe Mullis]

We have some Cisco 2911's that we are configuring 2 VPN's ( second is for redundancy) We are pretty confident on the failover VPN setup using SLA monitoring.

One thing we are stuck on is the redundant VPN will be setup over a 3G connection provided by verizon. Verizon issues a Private IP ( 192.168.100.X) the far end device terminating the VPN has a public ip of 183.172.22.XX , what kind of NAT translation do I need to make this work ?  Also does Cisco have any good configuration examples for VPN Failover setups for Cisco 2911's?

Any help would be appreciated !

[Julio Carvajal]

Hello Joe,

One thing we are stuck on is the redundant VPN will be setup over a 3G connection provided by verizon. Verizon issues a Private IP ( 192.168.100.X???

You will need to perform a port-forwarding for ports UDP 4500 and UDP 500 on the verizon router so that traffic gets redirected to the 2911 router so the tunnel gets stablished.. but the router will have the regular setup,

Regards,

Julio

[Joe Mullis]

So I will be OK using a private IP to initiate the VPN tunnel ? I was assuming I would need a public IP or else the Verizon router assisgning me the private IP would not know how to forward my request out? I am getting little to no help from Verizon on this matter and im just trying to iron out the details.

From my router if verizon gives me 192.168.1.2 and I setup the VPN with this IP, it will get forwarded to verizons router say its 192.168.1.1 that verizon router will not know what to do with my VPN request right? So i circumvent this issue I would need a public IP address from verizon or i would need verizon to push my VPN request out to my far end correct ?

[Julio Carvajal]

So I will be OK using a private IP to initiate the VPN tunnel ? I was assuming I would need a public IP or else the Verizon router assisgning me the private IP would not know how to forward my request out?

-You do need a public IP address to be able to communicate to the other site of the VPN, but that will be set on the verizon modem, So you will provide that ip to the other VPN site so they can use it as the VPN peer, Then on your modem or ISP router you will perform the already discussed port-forwarding

I think that explanation answers both questions, let me know if that is not the case!

Regards,

Julio