09-14-2018 01:07 PM - edited 02-21-2020 08:14 AM
Folks,
I have a requirement to connect two organizations using ASA VPN. They do not have overlapping space but still would like to NAT private address for additional security. The problem is that all the examples i have seem on Cisco sample configurations have the NAT pool of equal subnet masks. In my case it is different.
I have 3 class B subnets talking to 7 class C subnets. Is there a way i have achieve this by be being creaive with NAT pools. If yes, how?
I will surely rate any helpful post.
Thanks,
Solved! Go to Solution.
09-15-2018 07:12 PM
Hi,
Because the NAT is a local process you can hide each network behind another network with the same mask on each side, and then create the rule for send it through the tunnel to the opposite side using the new networks selected, is something like:
Customer A
10.10.10.0/16 NAT 1.1.1.0/16
20.20.20.0/16 NAT 2.2.2.0/16
30.30.30.0/16 NAT 3.3.3.0/16
Customer B
40.40.40.0/24 NAT 4.4.4.0/24
50.50.50.0/24 NAT 5.5.5.0/24
.
.
100.100.100.0/24 NAT 11.11.11.0/24
Then your VPN interesting traffic ACL should allows traffic between any of the NATed networks to the remote NATed networks something like allow 1.1.1.0/16 to 4.4.4.0/24 and a mirror config from the customer B side (4.4.4.0/24 to 1.1.1.0/16).
09-14-2018 01:13 PM
Basically what i have is the following:
Subnets Customer A Subnets Customer B
10.10.0.0/16 IPSEC 40.40.40.0/24
20.20.0.0/16 <---------------------------- > 50.50.50.0/24
30.30.0.0/16 60.60.60.0/24
70.70.70.0/24
80.80.80.0/24
90.90.90.0/24
100.100.100.0/24
09-15-2018 07:12 PM
Hi,
Because the NAT is a local process you can hide each network behind another network with the same mask on each side, and then create the rule for send it through the tunnel to the opposite side using the new networks selected, is something like:
Customer A
10.10.10.0/16 NAT 1.1.1.0/16
20.20.20.0/16 NAT 2.2.2.0/16
30.30.30.0/16 NAT 3.3.3.0/16
Customer B
40.40.40.0/24 NAT 4.4.4.0/24
50.50.50.0/24 NAT 5.5.5.0/24
.
.
100.100.100.0/24 NAT 11.11.11.0/24
Then your VPN interesting traffic ACL should allows traffic between any of the NATed networks to the remote NATed networks something like allow 1.1.1.0/16 to 4.4.4.0/24 and a mirror config from the customer B side (4.4.4.0/24 to 1.1.1.0/16).
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide