PIX: NAT before IPSec

[dhellmuth]

Hi,

We're building a LAN-to-LAN IPSec VPN between a PIX and a 3015 Concentrator.

The soure LAN (behind the PIX) uses the same private IPs than the destination LAN (behind the concentrator). We thought of NATing the private addresses of the client LAN on the outside interface of the PIX (PAT). Is this address translation performed before entering the tunnel ?

Any other ideas to solve the problem are welcome.

Thanks

Dirk

[awaheed]

Hi Dirk,

You should be able to get this working by doing static one to one NAT for the entire network, for getting an idea kindly look through the following sample config: http://www.cisco.com/warp/public/707/same-ip.html

The NAT happens before the actual IPSec so we can do NAT and then IPSec and this would work without a problem.

Hope this helps,

Regards,

Aamir

-=-=-

[dhellmuth]

Hi Aamir,

we tried it an it works fine.

Thanks for your help.

Regards

Dirk