OK I opened a TAC case on this subject and I wanted to share our findings. Yes it is possible though not entirely convenient.
Assumptions:
Remote/satellite office has a subnet of 10.10.10.0/24. Main Office has a subnet of 192.168.10.0/24. Because of an IP overlap, we must NAT the Satellite office's network to 10.10.20.0/24.
Here is the solution provided (in the words of my helpful support engineer):
------------------------------
--We first defined a pool of IP's over which the local LAN subnet will be translated to in case if it needs to communicate to Office Site(192.168.10.0/24) over the VPN tunnel.
ip nat pool VPN_NAT 10.10.20.1 10.10.20.254 netmask 255.255.255.0 type match-host
--We then created an ACL for the flow of traffic which is initiated from the LAN subnet and is destined for the Office site subnet, so that no traffic destined for internet should be NAT'ed to the local pool.
ip access-list extended NAT_VPN
permit ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
--We then integrate the pool and ACL and configured the below NAT statement which is used to NAT the IP's matched in the route-map nonat in which the ACL NAT_VPN will be matched and then is NAT'd on the local pool VPN_NAT. The reversible keyword will place a static entry after first packet is been initiated from the inside to outside so that after that dynamic NAT translation entry timed out, then also the traffic should be allowed which has been initiated from the outside to the inside.
ip nat inside source route-map nonat pool VPN_NAT reversible
--Since you have few devices(i.e printers) which cannot initiate a traffic from the inside to the outside and creates a static translation for itself in the translation table hence we configure the below static NAT statement so that it should create a static NAT statement in the translation table for the traffic initiated from the outside to inside. In addition to that we have configured a route-map so that it will only permit the traffic with a flow sourcing from LAN subnet going to the destination address(192.168.10.0/24) at Office site over the VPN.
ip nat inside source static 10,10.10.3 10.10.20.3 route-map nonat reversible
--------------------------------------------------------
The last step is the inconvenient one, in that we have to identify all machines on the Satellite network who will communicate with the Main Office but will not initiate that communication (e.g. printers and servers) and create static NAT entries for each of them. This statement does allow us to use the same route-map used by the other VPN traffic so internet traffic to/from these systems works properly.
So, the complete (relevant) config is as follows:
interface FastEthernet4
desc PUBLIC WAN INTERFACE
ip address 10.3.1.2 255.255.255.0
ip nat outside
ip inspect Firewall out
ip virtual-reassembly
no ip route-cache cef
no ip route-cache
duplex auto
speed auto
crypto map VpnMap
!
!
interface Vlan1
description PRIVATE LAN INTERFACE
ip address 10.10.10.1 255.255.255.0
ip nat inside
ip virtual-reassembly
no ip route-cache cef
no ip route-cache
ip tcp adjust-mss 1452
ip nat translation timeout never
ip nat pool VPN_NAT 10.10.20.1 10.10.20.254 netmask 255.255.255.0 type match-host
ip nat inside source route-map PrimaryNat interface FastEthernet4 overload
ip nat inside source route-map nonat pool VPN_NAT reversible
ip nat inside source static 10.10.10.3 10.10.20.3 route-map nonat
ip access-list extended NAT_VPN
permit ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
ip access-list extended aclNatOverload
deny ip 10.10.10.0 0.0.0.255 192.168.10.0 0.0.0.255
permit ip 10.10.10.0 0.0.0.255 any
route-map PrimaryNat permit 10
match ip address aclNatOverload
route-map nonat permit 10
match ip address NAT_VPN
Again, not completely optimal, but better than nothing, and it seems to work in my little, informal lab environment. Hope it helps anyone out there who has run into this situation...
Bob
