EzVPN Client and NAT

[mklimesch]

Hello,

i have configured a vpn between a router 1760 with adsl interface (ezvpn client) and a cisco concentrator 3005. the concentrator has got a static ip, the router has dynamic ip´s. now i have to translate the local ip´s at the end of the router. but when i configure nat at the router, i haven´t access to the other site of the vpn. can anybody explain this, or have anybody a sample config for me ?

Thanks in advance . . .

[gfullage]

EzVPN Phase II (available in 12.2(15)T and up) includes NAT interoperability support. Basically you configure NAt on the router for your Internet access, but when the VPN tunnel is up this overrides the configured NAT, then when the tunnel is torn down the configured NAT comes back in. See

http://www.cisco.com/univercd/cc/td/doc/product/software/ios122/122newft/122t/122t15/ftezvpnr.htm#1121329

for details. You should be able to run this code and configure your NAT as normal, and EzVPN will sort it all out for you depending on whether the tunnel is up or not.

If I've gotten the wrong impression of your situation (it's a little unclear), please provide configs and a more detailed explanation than "now i have to translate the local ip´s at the end of the router." cause this is unclear to me.

[mklimesch]

the net, where the router is placed has the ip 10.20.30.0/24. but i can´t route this net from my side. the source ip´s must be translate from 10.20.30.0 to 10.110.20.0. but when the tunnel is up, nat don´t works.

can i configure the vpn other than with the EzVPN Phase II ? I think not, because the router have to work as a vpn client, because it has no static ip . . .

[mklimesch]

i´ve forgot an important information. the adsl router is not in my network. it is placed in a partners network . . .

and they will access our network over the vpn.

[gfullage]

So you have to NAt over the tunnel, not out to the Internet, is that right? Hmmm, yeah, I don't see how that's going to work cause EzVPN specifically assumes that you don't need to NAT when the tunnel is up and it'll stop any configured NAT.

You could configure a standard LAN-to-LAN tunnel rather than EzVPN, then you could NAT the traffic before it gets encrypted.

[mklimesch]

Yes, thats right. I have to nat over the tunnel, not out to the internet.

Can I configure LAN-to-LAN tunnel ? I havent´t got a static ip on the outside interface of my router. So I think I have to configure Client-to-Site tunnel . . .

When I can configure LAN-to-LAN anyway, have you got a sample config for me ?