How do I setup PIX to Checkpoint IPSec VPN with NAT

[ed]

I have PIX IPSec VPN to Checkpoint sample config from Cisco.com and it makes sense ok.

Other IPSec sample configs are all based on nat0, but I need to NAT my traffic before it enters the VPN tunnel to the Checkpoint FW, using static nat mappings.

I am running PIX 6.3.2

Has anyone managed to get this working?

[pkapoor]

Yes, you can use statics if you want. The translation is not IPSec configuration. It is a seperate way to handle the traffic that aids VPN traffic.

So, the bottom line is, you can use statics instead of nat 0.

Paras

[pkapoor]

But remember that if you do a static, then it will override the nat/global translations. So, your hosts may not be able to get to the Internet. You may want to consider policy NAT as an option (but the effects of policy nat apply).

[e-aguilar]

A static translation should work. Just make sure you use a routable IP address otherwise you will be locked out of the Internet.

[ed]

thanks for your help