Showing results for 
Search instead for 
Did you mean: 

overlapping lan segments S2S tunnels (the other end)


Is there any way to policy nat incoming vpn S2S tunnel traffic?  I know we can policy nat out going to send traffic over a tunnel as something else...


my firewall

LAN segment

1st external firewall with s2s tunnel #1 back to my firewall


2nd external firewall with s2s tunnel #2 back to my firewall


if no changes can be made to the 1st and 2nd external firewall meaning we cannot get to at leat

one of them so they policy nat out as another there any thing we can do

on the "my firewall" ? (any incoming nat policy options or routes over the tunnel peer ip or something or the other???)

and this would be cisco asa's, all three at least.

thank you!

3 Replies 3

Rising star
Rising star

Hi there


Yes, there is a way you can do, it is policy base static-nat, please see the attached Cisco document in the reply.

I hope that helps.


Rizwan Rafeek

Message was edited by: Rizwan Mohamed

hi, i looked at the document and thank you for responding!  my scenario would be a little bit different though wherein we have another pix say "pix-C" which in the pdf would also be using

we couldn't make a 2nd policy nat for pix-C.  we couldnt have a 2nd source and destination ACL used for a 2nd policy map as the pix A would not know which access-list to use...

i know another option is public ip to public ip's for the site to site but that isnt always an option.


So going by the pdf you attached what if there was also a pix-C that is also using and we cannot make configuration changes on pix-B or pix-C just only on pix-A there anyway we can have the two site to sites A to B and A to C even though B and C both have ?

"even though B and C both have ?"

A policy static-nat must be done from either side "B" or "C" to masquerade as if, it has a different subnet as shown in the document, it is a workable solution.


Rizwan Rafeek

Message was edited by: Rizwan Mohamed

Getting Started

Find answers to your questions by entering keywords or phrases in the Search bar above. New here? Use these resources to familiarize yourself with the community:

Recognize Your Peers