IPSEC traffic bypassing NAT

[wgebers]

Hi All, 

First time posting here, so my apologies if I miss any relevant information. 

I have a requirement to access a legacy device on a remote network over our IPSEC tunnel. 

The remote network has an IR829 on site and an IKEv2 tunnel between the remote site and our main location. 

The legacy device does not have the IR829 set as it's pimary gateway, so in order to access it, I need the traffic to be NAT'd behind the GE4 interface. 

To achieve this, I have the following configuration: 

interface GigabitEthernet4
 switchport access vlan 10
 switchport mode access
 no ip address

interface Vlan10
 ip address XXX.XXX.XXX.A 
 ip nat outside
 ip virtual-reassembly in
 ip virtual-reassembly out

ip nat inside source route-map MAINT interface Vlan10 overload

ip access-list extended MAINT
 permit ip any XXX.XXX.XXX.0 0.0.0.255

route-map MAINT permit 10
 match ip address MAINT
 match interface Vlan10

interface Loopback0
 ip address YYY.YYY.YYY.YYY 255.255.255.255
 ip nat inside
 ip virtual-reassembly in

When I ping from the loopback address to the device and inspect the packets, I can see that the NAT is being applied and the traffic appears to originate from XXX.XXX.XXX.A 

When I ping the from the remote network to the device and inspect the packets, the NAT is not being applied and the traffic appears to originate from the remote network and the ping response fails. 

Is there an additional piece of configuration required to include the IPSEC inbound traffic in the NAT rule for this interface? 

Many thanks, 

[Georg Pauwen]

Hello,

where is the IPSec tunnel terminated ? Can you post the configuration of that device as well, or better yet, a schematic diagram of your topology ?

[MHM Cisco World]

of course this will happened the dynamic NAT is not bidirectional and hence the 
if you ping from INSIDE to OUTSIDE the ping will success and there is entry in NAT translate table 
this dynamic entry will be in table for default timeout 
if you Ping from OUTSIDE to INSIDE during the time the entry is appear the ping success if not the ping is failed.

so what is solution ??
config static NAT from Inside to VLAN., this give you bidirectional traffic.

[wgebers]

Thanks. 

I will setup the statc NAT and try. 

[paul driver]

Hello
In short ipsec and nat are incompatible as nat will translate the source host ip thus this natted address wont match with the ipsec source, So to make them work depends on where you ae performing NAT

Is it on the same device as the ipsec hosts or is it inpath between the two ipsec hosts?

With the first scenario both your rtrs will need to be able to support NAT-T (Network Translation Traversal) otherwise you will incure failure when you are running nat/ipsec between ipsec hosts.

Alternatively, if you have NAT in path between to ipsec hosts then you may be able to create a GRE tunnel with Ipsec to run over the NAT device

[wgebers]

Thanks Paul, 

I am starting to understand the problem. 

The traffic I am trying to NAT originates from a WAN interface that is outside NAT'd. 

I am then asking the router to NAT the same traffic behind another outside interface which is why it is not detected. 

So either I need to find a way to NAT outside to outside traffic (maybe via a loopback address in the middle), which would then cause the traffic to originate inside for the sake of the secondary interface. 

Or as you suggested, I need to have a GRE tunnel running over the IPSEC IKEv2 tunnel that then gives me an inside interface within the Cisco router. 

[MHM Cisco World]

Can you draw topolgy here 

[emurray]

Have you thought of configuring destination NAT on the IR829?

EDIT: My original post had source nat by mistake

[wgebers]

[MHM Cisco World]

try config NVI in loopback. 

[wgebers]

Thankyou for your replies. 

Topology attached. 

WAN interface is OUTSIDE NAT'd with exclusions for the Site-Site VPN traffic.