NAT rule in ASA for Tunnel interface

[Nitin S]

Hello All,

I have configure IPsec  VTI tunnel on ASA. i am try to configure NAT rule but interface not showing while adding nat statemen.

[Oleg Volkov]

What NAT rule you need?

[Nitin S]

i need NAT rule from INSIDE to VIT_Tunnel.

[Oleg Volkov]

Ok but why ?

Can You provide full rule ?

It is must be twice nat?

[Rob Ingram]

@Nitin S 

You shouldn't need to...

"VTI eliminates the need to use crypto access lists and Network Address Translation (NAT) exemption rules."

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/212478-configure-asa-virtual-tunnel-interfaces.html

If you are having an issue, please run packet-tracer from the CLI and "show nat detail", provide the output from both.

[Nitin S]

i need NAT rule to do destination NAT & source PAT.

[Rob Ingram]

@Nitin S 

You want to NAT traffic over the route based VPN? Normally when using a route based VPN you just route traffic over the tunnel without NAT, which is probably why the VTI interface does not show when attempting to create NAT rule. You could try "any" when specifying the interface name in a NAT rule.

[MHM Cisco World]

If I right it is bug 

[Massimo Baschieri]

Non applicable in all cases thuogh, but the "any" keyword may save your life.

Nat rule that should be entered this way:

nat (VTI,outside) source dynamic RFC1918-1 SRCNAT destination static DSTNETWORK DSTNETWORK

but it's not applicable since VTI interface isn't available, entered this way did the trick to me:

nat (any,outside) source dynamic RFC1918 SRCNAT destination static DSTNETWORK DSTNETWORK

[hansrodlo]

Thanks, this workaround works for me.

[fgfuentes]

this workaround actually does the job when using VTI: nat(any,interface)...