Site to site tunnel vpn traffic wit policy nat

[teymur azimov]

Hi dears. I want to configuration site to site vpn. The remote site need our local subnet must  10.193.115.0/24 traffic.

My local subnet 10.103.70.0/24. this subnet is also must be access to internet.

local subnet: 10.103.70. must be nat to 10.193.115.0 subnet at vpn traffic.

this is my configuration. is this correct config?  i confuse that my local subnet done twice nat. dynamic and pat. how is this working?

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

ip nat inside source list 100 interface GigabitEthernet0/0 overload                            ----Access to internet.(PAT)

for vpn traffic:

ip nat pool mswpool 10.193.115.1 10.193.115.14  netmask 255.255.255.240                         for vpn traffic.

  ip nat inside source list nat-ipsec pool mswpool

ip access-list extended vpn-traffic

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

ip access-list extended nat-ipsec

permit ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

[jawad-mukhtar]

For VPN

ip nat pool mswpool 10.193.115.1 10.193.115.254 prefix-length 24 type match-host

ip access-list extended NAT-ACL

permit ip 10.103.70.0 0.0.0.255 10.193.115.0 0.0.0.255

ip nat inside source list NAT-ACL pool mswpool overload

ip access-list extended vpn-acl

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

** Do Rate Helpful Posts***

[teymur azimov]

thank for reply me. please consider that my local user must access internet at same time and i do not need to do any change to pat nat configuration. am i right?

at last my config like that:

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

ip nat inside source list 100 interface GigabitEthernet0/0 overload                            ----Access to internet.(PAT)

For VPN

ip nat pool mswpool 10.193.115.1 10.193.115.254 prefix-length 24 type match-host

ip access-list extended NAT-ACL

permit ip 10.103.70.0 0.0.0.255 10.193.115.0 0.0.0.255

ip nat inside source list NAT-ACL pool mswpool overload

ip access-list extended vpn-acl

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

[jawad-mukhtar]

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

It will be Same

*** Do Rate Helpful Posts***

[jawad-mukhtar]

For VPN

ip nat pool mswpool 10.193.115.1 10.193.115.254 prefix-length 24 type match-host

ip access-list extended NAT-ACL

permit ip 10.103.70.0 0.0.0.255 10.193.128.0 0.0.1.255

ip nat inside source list NAT-ACL pool mswpool overload

ip access-list extended vpn-acl

permit ip 10.193.115.0 0.0.0.255  10.193.128.0 0.0.1.255

For Internet

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

[teymur azimov]

i check access list as you chanted it but i think that is not correct because

ip access-list extended NAT-ACL

permit ip 10.103.70.0 0.0.0.255 10.193.115.0 0.0.0.255

it must be like that

ip access-list extended nat-ipsec

permit ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

local user: 10.103.70.0/24

remote user:10.193.128.0.23

and remote side is need our local traffic must be 10.193.115.0/24

am i right?

[jawad-mukhtar]

Yes u re rite i have corrected above.

[teymur azimov]

i have one more question

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

access-list 100 permit ip 10.103.70.0 0.0.0.255 any

this access list for internet access but i write

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255

10.103.70.0 translate to 10.193.115.0 when they go 10.193.128.0 ok? so why i need

access-list 100 deny ip 10.103.70.0  0.0.0.255  10.193.128.0 0.0.1.255 line?

[jawad-mukhtar]

Because all of your traffic will be diverted toward Internet deny will exclude VPN traffic.

In simple world it will be natted by your public ip so you are exclulding 10.193.128.0 not to nat with public ip.

*** Do Rate Helpful Posts***