Problem reaching internal services over site-to-site while NAT configured

[Tommy Svensson]

Hi.

I'm having problems reaching internal services over my site-to-site tunnel while they have a NAT configured. 

Description:

On site A I have a MSR30 router and behind that I have a web server running sites on port 80 that I have made available externally through NAT.

On site B I have a Cisco 1921 router with some clients behind that.

Site A and site B have an IPsec site-to-site tunnel set up between them. 

Problem:

I can SSH from site B to the server on site A over the tunnel. If I configure a rule in the MSR30 to NAT SSH to the server it becomes available externally but I can't SSH from site B all of a sudden. Same goes for HTTP, if it has a NAT rule it becomes unavailable from site B.

What could be the problem here?

Kind regards, Tommy

[Karsten Iwen]

If you configure NAT, then this translation is done for the server regardless of the destination (Internet or VPN). You need to configure a NAT-exemption that doesn't do NAT when the communication peer is reached through the tunnel, but still does NAT when the peer is a system on the internet.

But as this has to be done on the MSR30, your question is better placed in a HP-forum.

[Tommy Svensson]

I have done the NAT-exemption on both ends to not make traffic destined for the tunnel not go out through NAT.

When I ping the DNS-record I've set up it goes locally, over the tunnel and the server answers. It's just when I use the port that I also set up a NAT rule for that it doesn't work. 

SSH works fine and goes over the tunnel as long as I don't have a NAT rule set up for port 22 to make it accessible externally.

Is there some general rule I'm missing about setting up NAT and site-to-site?

[Karsten Iwen · Accepted solution]

The problem-description exactly matches an environment where NAT-exemption is not in place. Parhaps there is something wrong in the order of the NAT-statements? But this HP-problem will probably not be solved in a Cisco-forum ... ;-)