NAT Client VPN Traffic to internet

[neilobrien]

Hi Guys,

I have a Cisco 2951 terminating my VPN's and I need my  VPN clients to access a public ip address but have the source address of  the router that terminates the VPN.

The VPN clients are split  tunnelled and I have added the public address to the split tunnel ACL in  order to bring it up through the tunnel but I'm sure I need to NAT it  back out from the router in some way.  I thought I needed to use "ip nat  outside...." but this only allows me to use NAT pools.

Can someone give me a pointer??

Thanks,

Neil

[Federico Coto Fajardo]

Hi,

Normally you don't NAT the VPN traffic and that's why the VPN clients can access the internal resources with their real private addresses.

If you want the VPN client to access the server with its public address, then you NAT the server through the VPN tunnel.

i.e.

Let's say the server is 10.1.1.1 with public IP 200.1.1.1

ip nat inside source static 10.1.1.1 200.1.1.1

Then, in the split-tunneling ACL:

ip access-list extended SPLIT

   permit ip host 200.1.1.1 VPN_CLIENT_SUBNET

In this way the communication through the tunnel flows between the Public IP of the server and the VPN subnet.

Federico.

[neilobrien]

Hi Federico,

The server I'm trying to access is not mine, it elsewhere on the internet.  But it only permits connections from my public ip, so I need clients who VPN into my network to go back out to this server but appear to be coming from my public ip.

Does that make sense?

THanks,

Neil

[Federico Coto Fajardo]

In that case you need to accept all the VPN client traffic and redirect it out to the Internet (doing PAT with your public IP) before sending the traffic to the Internet.

Federico.

[neilobrien]

Hi Federico,

I didn't think I needed to do that.  Because my VPN traffic is not crossing an NAT Inside interface, it's not going to get nat'd out like that.

i want to do what it is you're suggesting except only for one public ip.

On an ASA, you would just use the global nat statement with a routemap permitting the VPN client subnet to the pblic ip and that's it.

Thanks,

Neil

[Federico Coto Fajardo]

If having an ASA you will accept the VPN client traffic on the outside interface and hairpin the traffic backout doing NAT:

nat (outside) 1 VPN_POOL

global (outside) 1 interface

On a router I believe you cannot do that.

What you can do is receive the VPN traffic on the outside interface, redirect it to a loopback to have it NATed and backout the outside interface so it will get PATed to the public IP.

Federico.

[gatlin007]

This can be done on a router and here's a document that explains it:

http://www.cisco.com/en/US/products/sw/secursw/ps2308/products_configuration_example09186a008073b06b.shtml

Chris

[Federico Coto Fajardo]

The loopback trick will work, however Christopher's solution is even better :-)

Federico.

[neilobrien]

guys - this is exactly what I needed.

Thanks for your responses

Neil