VPN tunnel with NAT

[tpahuja]

Folks,

           I have a requirement to connect two organizations using ASA VPN. They do not have overlapping space but still would like to NAT private address for additional security. The problem is that all the examples i have seem on Cisco sample configurations have the NAT pool of equal subnet masks. In my case it is different.

I have 3 class B subnets talking to 7 class C subnets. Is there a way i have achieve this by be being creaive with NAT pools. If yes, how?

I will surely rate any helpful post.

Thanks,

[tpahuja]

Basically what i have is the following:

Subnets Customer A                                              Subnets Customer B

10.10.0.0/16                  IPSEC                              40.40.40.0/24

20.20.0.0/16 <---------------------------- > 50.50.50.0/24

30.30.0.0/16                                                         60.60.60.0/24

                                                                             70.70.70.0/24

                                                                             80.80.80.0/24

                                                                             90.90.90.0/24

                                                                             100.100.100.0/24

[josem.cortes · Accepted solution]

Hi,

Because the NAT is a local process you can hide each network behind another network with the same mask on each side, and then create the rule for send it through the tunnel to the opposite side using the new networks selected, is something like:

Customer A

10.10.10.0/16 NAT 1.1.1.0/16

20.20.20.0/16 NAT 2.2.2.0/16

30.30.30.0/16 NAT 3.3.3.0/16

Customer B

40.40.40.0/24 NAT 4.4.4.0/24

50.50.50.0/24 NAT 5.5.5.0/24

.

.

100.100.100.0/24 NAT 11.11.11.0/24

Then your VPN interesting traffic ACL should allows traffic between any of the NATed networks to the remote NATed networks something like allow 1.1.1.0/16 to 4.4.4.0/24 and a mirror config from the customer B side (4.4.4.0/24 to 1.1.1.0/16).