PAT VPN

[katheer4u]

Good Day

Please can you advise me can I create a VPN on the cisco 870 Router. it can work?

actually, I have one public static IP and many local hosts need to access the site over the VPN.

the end client allows only  public static IPs  

ip nat pool YIU_VPN 100.100.115.223 100.100.115.223 netmask 255.255.255.252
ip nat inside source list 108 interface Vlan2 overload
ip nat inside source route-map VPN-2-Remote pool YIU_VPN overload
ip nat inside source list 20 pool YIU_VPN overload
ip nat inside source list 30 pool YIU_VPN overload
ip nat inside source list 40 pool YIU_VPN overload
ip nat inside source list 50 pool YIU_VPN overload

access-list 20 permit 192.168.168.0 0.0.0.255
access-list 30 permit 192.168.222.0 0.0.0.255
access-list 40 permit 192.168.212.0 0.0.0.255
access-list 50 permit 192.168.213.0 0.0.0.255

route-map VPN-2-Remote permit 10
match ip address Nat-for-VPN


ip access-list extended Nat-for-VPN
permit ip object-group YIU_VPN host 99.218.192.100
permit ip object-group YIU_VPN host 99.218.192.97
permit ip object-group YIU_VPN host 99.218.182.100
permit ip object-group YIU_VPN host 99.218.182.109

object-group network YIU_VPN
range 192.168.213.0 192.168.213.255
range 192.168.212.0 192.168.212.255
range 192.168.222.0 192.168.222.255
range 192.168.168.0 192.168.168.255

[Rob Ingram]

@katheer4u so you want to NAT your internal networks when communicating over the VPN?

If so have you amended the crypto ACL that defines interesting traffic using the NAT address range instead of the real IP address range?

[katheer4u]

@Rob Ingram  

Yes, I want internal networks when communicating over the VPN.

but I have single public Ip (100.100.115.223 ).

the client (99.218.192.100) crypto ACL allow only our public IPs to access over the VPN

( we have already VPN tunnel with them ) this is the new product to access so there need new Public IPs 

i hope you get my point 

Thank you for the prompt replay I really appreciated if anyone can help 

[Rob Ingram]

@katheer4u ok....If so have you amended the crypto ACL that defines interesting traffic using the NAT address range instead of the real IP address range?

Provide the crypto configuration for review.

[katheer4u]

@Rob Ingram 

Please see the below 

ip nat inside source list 108 interface Vlan2 overload

ip nat pool YIU_VPN 100.100.115.223 100.100.115.223 netmask 255.255.255.252
ip nat inside source route-map VPN-2-Remote pool YIU_VPN overload
ip nat inside source list 20 pool YIU_VPN overload
ip nat inside source list 30 pool YIU_VPN overload
ip nat inside source list 40 pool YIU_VPN overload
ip nat inside source list 50 pool YIU_VPN overload

access-list 20 permit 192.168.168.0 0.0.0.255
access-list 30 permit 192.168.222.0 0.0.0.255
access-list 40 permit 192.168.212.0 0.0.0.255
access-list 50 permit 192.168.213.0 0.0.0.255

route-map VPN-2-Remote permit 10
match ip address Nat-for-VPN

ip access-list extended Nat-for-VPN
permit ip object-group YIU_VPN host 99.218.192.100
permit ip object-group YIU_VPN host 99.218.182.100

object-group network YIU_VPN
range 192.168.213.0 192.168.213.255
range 192.168.212.0 192.168.212.255
range 192.168.222.0 192.168.222.255
range 192.168.168.0 192.168.168.255

ip access-list extended vpn_PROD
permit ip host 100.100.115.223 host 99.218.192.100

ip access-list extended vpn_DRPRO
permit ip host 100.100.115.223 host 99.218.182.100

!
route-map VPN-2-Remote permit 10
match ip address Nat-for-VPN

access-list 110 permit ip host 100.100.115.223 host 99.218.192.100
access-list 110 permit ip host 99.218.192.100 host 100.100.115.223
access-list 109 permit ip host 100.100.115.223 host 99.218.182.100
access-list 109 permit ip host 99.218.182.100 host 100.100.115.223

crypto map cmap 10 ipsec-isakmp
set peer 222.101.221.10
set transform-set IPSEC_TSET1
match address 109
crypto map cmap 11 ipsec-isakmp
set peer 222.101.222.20
set transform-set IPSEC_TSET1
match address 110

protected vrf: (none)
local ident (addr/mask/prot/port): (99.218.182.100/255.255.255.255/0/0)
remote ident (addr/mask/prot/port): (100.100.115.223/255.255.255.255/0/0)
current_peer 222.101.221.10 port 500
PERMIT, flags={origin_is_acl,}
#pkts encaps: 0, #pkts encrypt: 0, #pkts digest: 0
#pkts decaps: 0, #pkts decrypt: 0, #pkts verify: 0
#pkts compressed: 0, #pkts decompressed: 0
#pkts not compressed: 0, #pkts compr. failed: 0
#pkts not decompressed: 0, #pkts decompress failed: 0
#pkts no sa (send) 0, #pkts invalid sa (rcv) 0
#pkts encaps failed (send) 0, #pkts decaps failed (rcv) 0
#pkts invalid prot (recv) 0, #pkts verify failed: 0
#pkts invalid identity (recv) 0, #pkts invalid len (rcv) 0
#pkts replay rollover (send): 0, #pkts replay rollover (rcv) 0
##pkts replay failed (rcv): 0
#pkts tagged (send): 0, #pkts untagged (rcv): 0
#pkts not tagged (send): 0, #pkts not untagged (rcv): 0
#pkts internal err (send): 0, #pkts internal err (recv) 0

local crypto endpt.: 100.100.115.220, remote crypto endpt.: 222.101.221.10
plaintext mtu 1500, path mtu 1500, ip mtu 1500, ip mtu idb Vlan2
current outbound spi: 0x0(0)
PFS (Y/N): N, DH group: none

inbound esp sas:

Interface: Vlan2
Session status: UP-ACTIVE
Peer: 222.101.221.10 port 500
Session ID: 0
IKEv1 SA: local 100.100.115.220/500 remote 222.101.221.10/500 Active
IPSEC FLOW: permit 6 0.0.0.0/0.0.0.0 port 80 0.0.0.0/0.0.0.0 port 80
Active SAs: 0, origin: crypto map
IPSEC FLOW: permit ip host 99.218.182.100 host 100.100.115.223
Active SAs: 0, origin: crypto map

Thank you for the prompt replay

[MHM Cisco World]

You want the traffic theough vpn not nat ? Can you more elaborate. 

[MHM Cisco World]

If I got you correctly then you can try config loopback and use it to PAT, then use the Host loopback with ACL of the IPSec VPN tunnel.
try this way if you can.

[katheer4u]

@MHM Cisco World 

Please can you provide me with the configuration if you don't mind? Thanks