NAT and interesting Traffic ACL

[SandevChopra07800]

Hi Folks, I need to configure a VPN tunnel from my CSR in such a way that I will have to PAT all interesting traffic to the outside interface ip. So lets say my Interesting Traffic ACL is src: my-local-subnet to dest: some-hosts-on-the-cust-side. I will then have to PAT it. Command is - 

ip nat inside source list INTERESTING-TRAFFIC-ACL interface gig1 overload extended

This is due to the Customer requirement to only allow 1 ip in the interesting ACL on their side and not get into overlapping subnet problems. Now the thing that is puzzling me is that, the interesting Traffic ACL is not matching on both the ends. How will the tunnel come up? 

Thoughts? 

[Rob Ingram]

Hi @SandevChopra07800 

The crypto ACL that defines the interesting traffic will need have the NAT IP address defined instead of the real IP address.

HTH

[SandevChopra07800]

Thnx. So in that case I will need 2 ACLs, one for the crypto and the other with real src-subnets that will be referred in the NAT statement? In other words - 

CRYPTO-ACL: src: outside-intf-ip, dst: cust-hosts  -----> Interesting Traffic ACL, will be matched/reversed on the Cust side. 

OTHER-ACL: src: local-subnet, dst: cust-hosts   ----> Will be used in the NAT statement as above. 

[Rob Ingram · Accepted solution]

If you are natting behind the outside interface you don't need another nat rule, the nat rule in your first post would achieve the desired result. You'd just need the crypto ACL to reference the source as the outside interface ip address rather than the real IP address.