03-06-2009 05:58 AM - edited 02-21-2020 04:10 PM
Hi,
I have IPSec tunnel from remote location to central location( Cisco 7200). Problem is that remote location is different company and they use some of address range that we also use.
How can I configure NAT translation of their addresses to one address in my range on my router(central location)? If I put "ip nat inside" on interface toward internet I don't think it will work because original packet is encrypted (tunnel ends on loopback interface). And also I don't know if there is the way to put "ip nat inside" on IPSec tunel.
If anyone have idea how to solve this please help.
Thanks,
A
03-06-2009 06:33 AM
Antonio -
On your router & on the remote router, you can change the address to a different subnet using the route-map option.
Lets say your network is 172.16.1.0 255.255.255.0 and the remote side network is the same as well. You want to change your network to 192.168.1.0 255.255.255.0 and the remote side to 192.168.2.0 255.255.255.0
On your router,
a. Create an ACL
access-list 100 per ip 192.168.1.0 0.0.0.255 192.168.2.0 0.0.0.255
b. Create a route-map
route-map CRYPTONAT per 10
match ip add 100
c. Create a static NAT with route-map option
ip nat inside source static 172.16.1.0 255.255.255.0 192.168.1.0 255.255.255.0 route-map CRYPTONAT
And you have to do this vice versa on the other end.
Let me know if this helps.
Thanks
Gilbert
03-06-2009 06:52 AM
Hi Gilbert,
Problem is that I have to do everything on my router (I don't administer the other side and they don't won't do change anything in their config).
Do I put "ip nat inside" on LAN interface and "ip nat outside" on WAN inteface or vice versa?
Thanks,
A
03-06-2009 07:38 AM
Hello Antonio,
You have to put "ip nat inside" on your LAN interface and "ip nat outside" on your WAN interface.
In this case, you have to write an ACL that matches the interesting traffic. If your network is 172.16.1.0/24 and remote network is the same. You cant have the same network as the source on destination on an ACL for crypto. The packets will be routed internally.
Or you can add another router internally before the LAN segment of the 7200 and NAT your network to a different range.
Will that work for you?
03-06-2009 08:15 AM
Thanks, It seems I will have to do that way.
regards,
A
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide