PIX with IPSec tunnel and NAT on tunnel

[gboshuizen]

We're using a PIX to build multiple IPSec tunnels to custommers.

Some of these custommers have overlapping IP networks.

The normal config of an IPsec tunnel is an "no_nat_acl" ACL and a statement to exclude IPSec traffic from NAT.

Is it possible to do NAT on a IPsec tunnel between two PIX firewalls?

Regards,

Godfried Boshuizen

The VisionWeb

[ovt]

Yes and No.

Yes, it is possible in general.

No, there are many corner cases. The most difficult problem is NAT'ing VPN traffic and Internet traffic simulteneously to different addresses. At least 6.3(2) is required for that, but this version is broken and deleted from the CCO.

Oleg Tipisov,

REDCENTER,

Moscow