How to nat subnets before establishing site to site ipsec vpn tunnel?

[puneitsupport]

Hello,

Coming across requirement which is new to me as I have not done this setup. Details as follows. Hope some1 can help.

Requirement: nat existing subnets to 192.168.50.0/24 subnet which is allowed at another firewall.

Existing device: Cisco 5510 where I need to do this NAT.

Existing scenario in short: I have created vlans on asa by creating sub interfaces.

Changes done: added new sub int for 192.168.50.0. Added new object as 192.168.50.0 . Now done with creation of acl where traffic from 192.168.50.0 to remote subnets allowed. In NAT object sections done nating 1 to 1 I.e. existing subnet to 192.168.50.0

Done ipsec vpn setup inc phase 1 & 2.

Now tried to ping remote hosts but not reachable.

Pls advice how to make it work.

I dont any router next to asa 5510. Asa is in routed mode. Next hop to asa is isp's mux.

[Jouni Forss]

Hi,

Can you clarify the setup a bit.

I first got the picture that the NAT network is 192.168.50.0/24 and some other networks should be NATed to this.

Later on it seems that you have configured this to some interface on the ASA?

So are you attempting to NAT some other LAN networks to this single NAT network before the traffic heads to the L2L VPN connection on your ASA?

Can you then mention what are the source networks and source interfaces for these networks? What is the destination network at the remote end of the L2L VPN connection?

Do you want to just do a NAT Pool of the 192.168.50.0/24 network for all your Internet users OR does the remote end also have to be able to connect to some of your sites hosts/servers?

What is the software version of your ASA?

- Jouni