Policy Nat on cisco router

[teymur azimov]

Hi Dears.

I configurated site to site vpn on router. The peer want interesting traffic to our side user subnet must be  10.193.115.11 but our local subnet is

10.103.70.0/24. our local subnet is also access to internet.

local subnet: 10.10.3.70.0/24

peer local  subnet: 10.193.128.11/23

i think that i must be do policy nat.

1. ip access-list extended vpn-traffic  

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

2. ip access-list extended nat-ipsec

permit ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

3.ip nat pool mswpool 10.193.115.1 10.193.115.14  netmask 255.255.255.240

  ip nat inside source list nat-ipsec pool mswpool

And i have also PAT Nat for local user.

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

ip nat inside source list 100 interface GigabitEthernet0/0 overload

is this configuration rigth?

please write your comment.

thanks.

[olpeleri]

Crypto ACL should match the addresses after nat [ not before nat]

[teymur azimov]

Hi. thank you to reply me. i confuse that, please if it is possibly can you show me.

[olpeleri]

My bad...

it looks ok in fact

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

[teymur azimov]

I confuse something my configuration.

local user (10.103.70.0) go internet with PAT nat. it is ok for me.

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

ip nat inside source list 100 interface GigabitEthernet0/0 overload

the second part local user to do second nat which is policy nat.

permit ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

ip nat pool mswpool 10.193.115.1 10.193.115.14  netmask 255.255.255.240

  ip nat inside source list nat-ipsec pool mswpool

i want to said that as you see the configuration the same subnet done twice nat.

how is it working?

[teymur azimov]

or as you vpn traffic is ok and what about internet access for local user. the configuration PAT NAt is enougth it or  is it correct config?

[olpeleri]

U should avoid any ambiguity by having

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

[teymur azimov]

ok. thanks.

at last our configuration is that:

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

ip nat inside source list 100 interface GigabitEthernet0/0 overload

for vpn traffic:

ip nat pool mswpool 10.193.115.1 10.193.115.14  netmask 255.255.255.240

  ip nat inside source list nat-ipsec pool mswpool

ip access-list extended vpn-traffic 

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

ip access-list extended nat-ipsec

permit ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

you said that this configuration is help me for my aim.

thanks again.