Site-to-Site IPSec VPN Encryption domain question

[Craddockc]

Dear Community,

I am set to build a site to site IPSec VPN from a Cisco 5545x ASA to a client. We are going to NAT our internal traffic (the interesting traffic) before sending it to the remote peer, so they will be acceptiong traffic from our external address range. My question is, when im defining the interesting traffic for the encryption domain on our side in the VPN setup procedures, do I define the inside local addresses (the internal private IP's) or do I define the outside local addresses (the NATed external IPs) in the setup? I ask because im not sure if the IPs get NATed before being placed into the tunnel or after. The ASA will be hosting the tunnel and doing the NATing as well through the NAT Policy.

Thanks.

Chris.

[Rahul Govindan · Accepted solution]

NAT takes place before crypto policies are checked. So your crypto access-lists should have the translated ip address (external).

[Craddockc]

Rahul,

Thanks so much for the clarification. I truly appreciate it!