PAT'ng with VPN

[mjsully]

Is it possible to PAT a group of addresses to the external ip address of a PIX and at the same time have that same outside interface as a tunnel endpoint for sending the PAT'd addresses out to the peer address of the pix?

[jose.couto]

I think that it is not possible to do what you want. For lan-to-lan tunnels, you should use NAT, not PAT, as the other end may initiate the IPsec negotiation (in fact, most of the configuration examples I have seen tell you to disable NAT). To which internal IP address will the PIX deliver a packet sent to the PAT address?

Regards.