NAT to different private address prior to VPN tunnel

[mpitts]

I have an application that will use a site-to-site VPN tunnel from PIX 6.3(3) to a VPN concentrator. The VPN concentrator is already supporting the same private address network for another connection and requires that we NAT on the PIX only for this connection, without disrupting the existing traditional NAT between Inside and Outside interfaces.

I have been through much documentation trying to figure this out, and the implication I gathered is that this can be accomplished with Policy NAT but there's not much in the way of definitive examples.

If anyone has done this successfully I would appreciate an example of the configuration.

Thanks,

Mike

[mchin345]

This document gives an overview of the configuration required to allow a Cisco Secure PIX Firewall and a Cisco VPN 500x Concentrator to open an IPSec LAN-to-LAN tunnel. For information about how to establish basic connectivity, or for reference on configuration syntax, consult the VPN 5000 Concentrator documentation and the PIX documentation.

http://www.cisco.com/en/US/products/hw/vpndevc/ps2301/products_configuration_example09186a0080093f6b.shtml

[johansens]

Hi there,

I wrote a quick example for you which you probably can use with some modifications.

1.1.1.0/24 is the NAT'ed addresses

2.2.2.0/24 is the other sites addresses

3.3.3.0/24 is the real addresses on your PIX site

4.4.4.0/24 is the outside addresses on your PIX site

5.5.5.0/24 is the outside addresses on the other site.

access-list init-ipsec permit 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0

access-list nonat permit 1.1.1.0 255.255.255.0 2.2.2.0 255.255.255.0

access-list policy permit 3.3.3.0 255.255.255.0 2.2.2.0 255.255.255.0

ip address inside 3.3.3.1 255.255.255.0

ip address outside 4.4.4.2 255.255.255.0

nat (inside) 0 access-list nonat

nat (inside) 1 access-list policy

nat (inside) 2 3.3.3.0 255.255.255.0

global (outside) 1 1.1.1.1-1.1.1.254 netmask 255.255.255.0

global (outside) 2 interface

route outside 0.0.0.0 0.0.0.0 4.4.4.1

sysopt connection permit-ipsec

crypto ipsec transform-set 3desmd5 esp-3des esp-md5-hmac

crypto ipsec security-association lifetime seconds 3600

crypto map cmap 5 ipsec-isakmp

crypto map cmap 5 match address init-ipsec

crypto map cmap 5 set peer 5.5.5.2

crypto map cmap 5 set transform-set 3desmd5

crypto map cmap interface outside

isakmp enable outside

isakmp key foobar address 5.5.5.2 netmask 255.255.255.255

isakmp identity address

isakmp policy 5 authentication pre-share

isakmp policy 5 encryption 3des

isakmp policy 5 hash md5

isakmp policy 5 group 2

isakmp policy 5 lifetime 86400

Did it help?

[mpitts]

The logic seems to make sense at first glance. I will check it against the customer's current configuration and see if he is willing to try it. The response he got from TAC was that the only viable option he had was to re-address his network.

If I can try it, I'll certainly let you know if it worked.

Thanks,

Mike