Site to Site VPN issue

[Joe Lee]

Hello,

Here is my client's network diagram

Internet connection-> firewall -> router-> switch

The outside interface of the firewall is connected to the internt with static or dynamic public IP address; The private IP addresses are configured in the inside interface of the firewall and the router.

My client wants to terminate the site to site VPN on the Cisco router. Keep in mind the router has private IP address. Will that be possible? Can you please advise?

Regards,

Joe

[KARUPPUCHAMY MALAIYANDI]

Here you go

https://supportforums.cisco.com/thread/343363

Thanks / Samy

[Joe Lee]

Hi Samy,

Looks i need to run dynamic VPN on the router, same question...Can i terminate the VPN on the private IP address of the router?

Regards,

Joe

[Aileron88]

Could I ask the reason behind the decision to terminate this VPN on the router?

Sent from Cisco Technical Support iPad App

[Richard Burts]

Joe

One of the requirements for establishing a VPN is that the remote device must have IP connectivity to the VPN end point without using the tunnel. Can the remote device access the router interface when it has a private address? With static address translation it might be possible. Without static address translation it would not be possible.

HTH

Rick

[Joe Lee]

Hi Rick,

Can I configure the one to one NAT on the firewall and terminate the VPN on the router?

Regards,

Joe

[jowegrzy]

Hi Joe,

Which device ( router or firewall ) is the VPN endpoint peer?

Joshua

[Joe Lee]

Hi Joshua,

The end poin peer is the router.

Thanks!

Joe

[mfurnival]

You will need to setup a VIP on the firewall (or whatever your firewall vendor calls it) so that traffic hitting the public address is forwarded to the private address of your internal router. You would need a rule on the firewall to allow the VPN traffic through. It is a bit of a weird thing to do though because you are bypassing the firewall by tunneling through it.