Site to site tunneling with PIX and NAT before entering the tunnel

[andrea.semenzato]

Hello,

I need to setup a site to site tunnel with cisco PIX
Local network is 10.61.13.0/24   and  remote networks are 10.17.160.0/23  and 10.9.160.0/23
In this situation I'm able to close phase 1 and phase 2 with no prb

But the problem is that for remote networks my local network must be 10.104.204.19/32
I mean, before entering the tunnel, IPs of local network (10.61.13.x) have to translated in 10.104.204.19/32
PIX has to make NAT/PAT so packet sources entering the tunnel are always 10.104.204.19

Where am I wrong?
Thank you very much and here a snippet of my config.

PIX Version 6.3(5)

access-list NoNAT permit ip host 10.104.204.19  10.17.160.0  255.255.254.0
access-list NoNAT permit ip host 10.104.204.19  10.9.160.0   255.255.254.0

global (outside) 1 interface
global (inside) 2 10.104.204.19

nat (inside) 0 access-list NoNAT
nat (inside) 2 10.9.160.0 255.255.254.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

route outside 0.0.0.0 0.0.0.0 [Intenet gateway] 1
route outside 10.9.160.0 255.255.254.0 [remote VPN peer] 1
route outside 10.17.160.0 255.255.254.0 [remote VPN peer] 1

sysopt connection permit-ipsec
crypto ipsec transform-set TUNNEL esp-aes esp-sha-hmac
crypto ipsec security-association lifetime seconds 3600
crypto map CRYPTOMAP 10 ipsec-isakmp
crypto map CRYPTOMAP 10 match address NoNAT
crypto map CRYPTOMAP 10 set pfs group5
crypto map CRYPTOMAP 10 set peer [remote VPN peer]
crypto map CRYPTOMAP 10 set transform-set TUNNEL
crypto map CRYPTOMAP interface outside

isakmp enable outside
isakmp key ******** address [remote VPN peer] netmask 255.255.255.255
isakmp identity address
isakmp policy 1 authentication pre-share
isakmp policy 1 encryption aes-256
isakmp policy 1 hash sha
isakmp policy 1 group 5
isakmp policy 1 lifetime 28800

[Jon Marshall]

Your configuration is a little confusing ie. you have -

nat (inside) 2 10.9.160.0 255.255.254.0 0 0  <-- this is one of the remote networks
global (inside) 2 10.104.204.19

but then you say you are trying to NAT 10.61.13.0/24 to 10.104.204.19.

Is there a typo in the above ?

Jon

[andrea.semenzato]

I'm  a little confusing, but Yes,

I'm trying to translate 10.61.13.0/24 to 10.104.204.19 before entering the VPN tunnel over Internet

Remote networks route only 10.104.204.19 and they don't know 10.61.13.0/24

Thank you very much.

I think the prb is in these configs (but no idea where)

global (outside) 1 interface
global (inside) 2 10.104.204.19

nat (inside) 0 access-list NoNAT
nat (inside) 2 10.9.160.0 255.255.254.0 0 0
nat (inside) 1 0.0.0.0 0.0.0.0 0 0

[Jon Marshall · Accepted solution]

Okay so you need to use policy NAT ie. you only want to translate 10.61.13.0/24 to 10.104.204.19 when using the VPN. So firstly remove that NAT statement -

"no nat (inside) 2 10.9.160.0 255.255.254.0 0 0"

then define an acl for the VPN traffic -

"access-list <name> permit ip 10.61.13.0 255.255.255.0 10.9.160.0 255.255.254.0"
"access-list <name> permit ip 10.61.13.0 255.255.255.0 10.17.160.0 255.255.254.0"

then tie it the global statement so -

"nat (inside)  2 access-list <name>"

Jon

[andrea.semenzato]

Really I'm still not able to close phase 2, but the prb now is on the other side,

Thank you very much Jon