Temp NAT vpn traffic target on 2801

[abclabsmo]

So here is the story... I have a 2801 that is the VPN endpoint for our Avaya phones using their built in VPN client.  Working fine.  However I am going to have to change the IP of our Avaya phone server so I would like to predeploy replacement avaya phones with the new phone server IP setup.

I need to get the traffic coming over the VPN tunnel from phones that will be trying to go to the new IP of 10.2.140.10 to actually go the current IP of 10.200.96.253.  And traffic coming over the VPN tunnel to the current IP of 10.200.96.253 needs to be left alone.  I have been trying to figure out some kind of destination NAT with no luck.  Tried a static NAT and that breaks things since it translates all of the traffic.

Anyone have any wizardry for this?

Thx.

[Jon Marshall]

The static NAT breaks it because it translates the IPs even when you don't want that to happen ? 

Are the phones using the new IP distinguishable from the ones using the old IP ie. you may be able to use a route map and acls with your NAT to specify exactly which IPs should be translated etc. 

Jon

[abclabsmo]

HI..

The only difference with the new phones would be the target IP of the traffic.  Else nothing else is different.

Hmmm...Route map.  Had not thought of that and haven't done one in many years.  Will start digging!

[paul driver]

Hello

Would you be able to post simple topology of this flow to show to get a better understanding of what you are trying to achieve?

[abclabsmo]

Hi...Sorry I don't have one handy.... But it is pretty simple anyhow..
I need VPN traffic that is trying to go to 10.2.140.10 to actually go to 10.200.96.253. And, for now, any traffic going already going to/from 10.200.96.253 left alone. A kind of destination based nat.

[abclabsmo · Accepted solution]

I managed to get this sorted out by approaching this from a different angle. I setup another VPN group with a different DHCP pool and was able to use that different DHCP pool to identify the traffic and do a route map and NAT based on that.
It looked like below... The stmt took care of traffic in both directions and did not interfere with prod.
ip nat inside source static 10.200.96.253 10.2.140.10 route-map newphone
Thx for the clue about using route map.