RA VPN pool nating

pemasirid · ‎10-18-2009

Hi,

I'm trying to do the NATing for VPN client pool as inside servers are accepting only some allowed ip subnet.

My vpn client pool is using 172.16.1.x/24 and inside users are allow to access only from 141.146.130.x/28 as source subnet.

For that I did the following ACS and NATing

access-list nonat extended permit ip host 141.146.130.130 140.85.0.0 255.255.0.0

access-list nonat extended permit ip host 141.146.130.130 144.23.0.0 255.255.0.0

access-list nonat extended permit ip host 141.146.130.130 141.146.128.0 255.255.128.0

access-list policy_nat extended permit ip 140.85.0.0 255.255.0.0 172.16.1.0 255.255.255.0

access-list policy_nat extended permit ip 144.23.0.0 255.255.0.0 172.16.1.0 255.255.255.0

access-list policy_nat extended permit ip 141.146.128.0 255.255.128.0 172.16.1.0 255.255.255.0

access-list Oracle_OnDemand extended permit ip host 141.146.130.130 140.85.0.0 255.255.0.0

access-list Oracle_OnDemand extended permit ip host 141.146.130.130 144.23.0.0 255.255.0.0

access-list Oracle_OnDemand extended permit ip host 141.146.130.130 141.146.128.0 255.255.128.0

nat (inside) 0 access-list nonat

nat (inside) 5 access-list policy_nat

nat (outside) 5 141.146.130.130 netmask 255.255.255.255

Although I'm connected to VPN and getting IP from 172.16.1.x/24 subnet I'm not able to access trust subnet (ie. 140.85.0.0/16.

Attached is the running-config with some show commands after connecting VPN.

When I check VPN Client statics I could not see any subnet under secure routes.

Can someone help me on this?,

thanks

Erik Ingeberg · ‎10-19-2009

Hi,

I'm confused as to why you want to use policy nat here. As you show in your screenshot, the VPN client is not using split tunneling, so it should be able to reach all networks known to the ASA.

Also, you have no "global" statement to match your nat statement used for policy nat. To use policy nat, here is an example:

nat (inside) 5 access-list policy_nat

global (outside) 5 141.146.130.130 netmask 255.255.255.255

The only thing you need is a "no nat" rule for traffic going back to the VPN clients.

You can add this line to your nonat ACL:

access-list nonat extended permit ip 140.85.0.0 255.255.0.0 172.16.1.0 255.255.255.0

Otherwise you could use this line to make all networks available to the VPN clients:

access-list nonat extended permit ip any 172.16.1.0 255.255.255.0