Establishing an IPSEC VPN Behind Another ASA Device

[FoxtrotRomeo]

Attached are the configuration files for the devices in question.  I have a 5510 that belongs to my company and a 5505 that belongs to another company.  The 5505 sits behind the 5510 and is able to connect to the Internet.  My thought was that VPN access should be a trivial pursuit.  I was planning on just giving the admin at the remote office the public IP address that's natted to the 5505 and all would be good.  Am I off base?  If so, why? 

Based on the configuration, what NAT issues will I run into? 

[FoxtrotRomeo]

Will IPSEC passthrough solve the problem I'm having here without affecting existing VPN clients?

[FoxtrotRomeo]

I added the following static NAT entry:

static (Other Company,outside) 12.x.x.91 10.10.8.1 netmask 255.255.255.255

So basically I'm hoping that traffic originating from the Other Company interface will be translated as the public IP 12.x.x.91. 

Edit: attached is a more current config of the 5510. 

[FoxtrotRomeo]

Update:

I changed the config to:

static (Other Company,outside) 12.x.x.91 10.10.8.2 netmask 255.255.255.255

My will this conflict with any dynamic NAT rules on the same interface?

[FoxtrotRomeo]

Okay no response probably means that I managed to confuse all of you.  Here is a diagram that shows what I'm trying to do and whether or not I can expect NAT problems:

I'm trying to create an IPSEC VPN tunnel between the Other Company network and Other Company remote office.  This IPSEC will pass through My Company router.  Is this possible without running into NAT issues? 

[Javier Portuguez]

Thanks for posting your question.

Quick question:

As long as you have a static one to one translation using a different IP address than the outside IP, you will not experience any problems.

If you use the same IP as the outside, other connections will stop to work.

You can also take in to the account the IPsec inspection, to avoid adding extra ACLs to allow VPN connections initiated from the inside.

Please let us know if that answers your questions.

Thanks.

[FoxtrotRomeo]

We're running into NAT translation errors.  This is causing the VPN tunnel to only work in one direction.  What could be the cause?

[Mohammad Alhyari]

hi ,

you are using static translation so connection can be initiated from both sides.

which translation errors you are seeing ?

can you paste your config after adding the NAT ? and also explain what happen when you try to initiate the vpn in the direction that is not working !

cheers.