How to Twice-NAT(Nat-exempt and overload) On IOS

[Aaron_un]

This is how I do it on ASA

object network L2L_NAT_OVERLOAD_IP
 host 10.200.255.1

object network L2L_NAT_DST
 subnet 172.1.1.0 255.255.255.0

nat (INSIDE, OUTSIDE) source dynamic LAN_INTERNAL L2L_NAT_OVERLOAD_IP destination static L2L_NAT_DST L2L_NAT_DST

this command will overload all the internal ips that are heading through tunnel, while It exempting this traffic that heads to L2L_NAT_DST from being natted by another general(all packets) overload nat command

how can I achieve the same thing on IOS?

so imagine I have this nat line on my IOS which I don't want to be trapped by and jump over it and at the same time I want to overload my outgoing traffic heading to ipsec destination networks with another IP

ip nat inside source list 1 interface GigabitEthernet0/0 overload

^ so this command is not in my interest, this has to be there for the whole network internet

aside from this one I need to add(simulate asa nat) another nat to exempt the traffic from this^ nat and at the same time overload the sources of those packets that are exempted with a single ip:many ports fashion

[paul driver]

Hello

If i understood, you wish to NOT to perfrom nat for traffic between 172.1.1.0/24 and host 10.200.255.1 but NAT for any other traffic sourced from 172.1.1.0/24?

If so example below:

ip access-list extended NAT
deny ip 172.1.1.0 0.0.0.255 host 10.200.255.1
permit ip 172.1.1.0 0.0.0.255 any
ip nat inside source list NAT interface x/x

[Aaron_un]

no that's not true.

IPs with the DST 172.1.1.0 255.255.255.0, shouldn't be NATted by other nats, but I still want to NAT their source IP with overload method to 10.200.255.1, while the general overload of my outside interface is still doing its job, by overload patting all insides 0.0.0.0/0 traffic with outside interface IP.

[paul driver]

Hello

Okay then just change the acl to acomodate what you dont wont to NAT between source /destination

ip access-list extended NAT
deny ip  <inside lan subnet> 172.1.1.0 0.0.0.255
permit ip <inside lan subnet> any
ip nat inside source list NAT interface x/x

[Aaron_un]

sir that's the thing it's not that easy, again and again, this is not only nat exempt, it's nat exempt and overload nat at the same time.

by nat exempt I am trying to escape from the OVERLOAD ALL which is common on all networks, but still I need to nat the traffic(source ips) that already exempted to another source ip(10.200.255.1).

you command accomplishes this

nat (INSIDE, OUTSIDE) source dynamic LAN_INTERNAL LAN_INTERNAL destination static L2L_NAT_DST L2L_NAT_DST

not this

nat (INSIDE, OUTSIDE) source dynamic LAN_INTERNAL L2L_NAT_OVERLOAD_IP destination static L2L_NAT_DST L2L_NAT_DST

[Scott Leport]

Hi,

If I have understood you correctly, you want to translate the inside subnet to 10.200.255.1 when communicating through the VPN tunnel and 10.200.255.1 is also your NAT overload address?

This seems a bit broken to me, but perhaps the following config might help?

ip access-list extended ACL-NAT

 permit ip <your inside subnet> <wildcard mask> any

route-map RMAP-NAT

 match ip address ACL-NAT

ip nat inside source list RMAP-NAT int gi0/0 overload

ip access-list extended VPN-TRAFFIC

 deny ip host 10.200.255.1 192.168.1.0 0.0.0.255 (modify destination subnet to fit your needs)

 permit ip host 10.200.255.1 any

[Aaron_un]

I am sorry,

let me put the other nat as well, but remember if you don't understand this ASA command, the more I verbalize this in english the harder it gets, I am trying to simulate the same command here on router

object network L2L_NAT_OVERLOAD_IP
 host 10.200.255.1

object network L2L_NAT_DST
 subnet 172.1.1.0 255.255.255.0

#ips that are heading to the other side of the tunnel will be natted to 10.200.255.1 and exempted by the whole network nat overload command
nat (INSIDE, OUTSIDE) source dynamic LAN_INTERNAL L2L_NAT_OVERLOAD_IP destination static L2L_NAT_DST L2L_NAT_DST

#the whole network nat overload command
object network NET_OVERLOAD
  subnet 0.0.0.0/0
  nat (INSIDE, OUTSIDE) source dynamic interface

Ok I think this is what I was looking for

ip nat pool test-robot 10.200.255.1 10.200.255.1 netmask 255.255.255.255 ip nat inside source list RMAP-NAT pool test-r overload

ip access-list extended ACL-LAN
 permit ip any 172.1.1.0/24

route-map RMAP-NAT
 match ip address ACL-LAN

ip access-list extended NAT-Exempt
 deny ip any 172.1.1.0/24
 permit any any
 
ip nat inside source list NAT-Exempt interface x/x
ip nat inside source list RMAP