NAT configuration for servers which act as both initiator & Responder

[Aaida]

Hi,

I am having below scenario.

1. I have one internal server a.a.a.a which having NATed IP b.b.b.b

2. The internal server is connecting to outside server c.c.c.c over ipsec VPN.

3. The outside server c.c.c.c will also initiate traffic to inside servers NAT IP b.b.b.b. which means both side initiation is there. Please note that i am not talking about reverse traffic of same session.

Now my question is whether i need to put two NAT rules, one to translate for inbound traffic and other to translate for outbound traffic. is that required. or one NAT rule will serve the purpose?

[Aaida]

a.a.a.a is our internal server which should be nated to b.b.b.b before sending to third party network.  Hence third party only knows natted ip. Their c.c.c.c also initiates traffic to our b.b.b.b over VPN. Hence when it comes to our  router , after decryption  the destinaton of packet should be natted to our original internal IP. Since this traffic is not a reverse packet of already initiated internal session I got confused whether I need to put one more nat rule for inbound traffic.  Hope this is clear 

[MHM Cisco World]

Yes it clear I want to be sure, 
so the b.b.b.b is IP of interface that is not config under it the IPsec crypto map ?

[Aaida]

I am sorry,The question is not that much clear. b.b.b.b is an ip assigned particularly for nating purpose.  And the same will be configured in crypto map as well. 

[MHM Cisco World]

this not work Sorry as I know. 
but I will try lab today BUT 75% it not work. 
the traffic hit the ACL then NATing then send to Peer, other router see different IP than ACL of  policy VPN and not decrypt data.
thanks 
MHM

[paul driver]

Hello

---

@Aaida wrote:

Now my question is whether i need to put two NAT rules, one to translate for inbound traffic and other to translate for outbound traffic. is that required. or one NAT rule will serve the purpose?

---

No you don't, just the one static NAT (not PAT) statement will be applicable to allow you to initiate egress-ingress connection towards the inside-global NAT ip address.

[EdsonZ]

If possible please share your network design.