I have probably been staring at this too long and I am therefore missing something.
I have a requirement for a VPN tunnel to another vendor, but this tunnel is only going to allow for three internal LAN hosts to have access in to the vendor's network. Additionally, the subnets overlap, so those three hosts need to be NATed Not too terribly hard, right? Well, I did manage to get it working, however now the three LAN hosts are ALWAYS being NATed and therefore can't get to the internet.
Basically, I am trying to have it NAT to these specific IP's only when the packets are coming from these three hosts and are destined to the vendor's networks (over the VPN tunnel). For all other communication to the outside, I want it to NAT like any other hosts on the local LAN subnet.
The LAN is : 172.16.50.0/24 and the hosts are .90,.206, and .214
The NAT is: 10.224.1.25 through .26
I went about and created a Network Objects for the NAT'ed IP's for each of the three hosts: HostA_NAT, HostB_NAT, HostC_NAT
I created Network Objects for the LAN IP's for each of the three hosts. In doing so, I selected "Add Automatic Translation Rules" and selected the Network Object for the NAT'ed IP that correspondes. So for HostA, I selected "HostA_NAT" and so on.
I also created the ACL from the source address of the NATed IP's to the vendor's networks.
Now, the result is that the vendor can communicate to these hosts, and these hosts can communicate back, but these hosts cannot communicate to out to the internet.
I know I must be missing something simple here, and I suspect it has to do with the static nat setup. However, I am at a loss as to where to look.
I would personally like to see the NAT configurations in CLI format.
I presume that you have now configured basically Static NAT with the Network Object NAT configurations. This means that this NAT will be used for any destination address behind the "outside" interface and therefore its causing problems for your Internet traffic too.
So the NAT configurations should instead look something like this
Using the above configuration would mean that the NAT for the L2L VPN connection would only be applied to these 3 hosts when the destination network was the subnet configured under REMOTE-LAN.
Notice that the Real and Mapped source addresses are mapped between eachother in the order they are entered inside the "object-group". You have the option ofcourse creating an "object network" or "object-group network" for each host separately and pair them that way. You would also need 3 NAT configurations to do all them that way.
Community Live Event Video
Are you ready to level up your security? Learn more about how Cisco SecureX can help you simplify your security and maximize operational efficiency.
This event talks about Cisco SecureX, its benefits, features, and usage. Th...
Hi all,I cannot understand why is something working very well they create a way to complicate things in Cisco ASA OS. I have a rule :object network LOCAL_ADRESS1 host 192.168.20.12 nat (VLAN20,outside) source static LOCAL_ADRESS1 interface&...
It is our pleasure to officially announce the finalists in the 2021 IT Blog Awards. We are now looking to our amazing tech community to check out the amazing line up of bloggers, vloggers and podcasters. Make sure to vote for your favorites...
Community Live Event Slides
This event talks about Cisco SecureX, its benefits, features, and usage. The session includes sample use cases and live demonstrations.
Cisco expert Luis Silva talks about how this solution can integrate Cisco technology and ...
Hello All, Recently I got an opportunity to perform POC with Cisco ISE (2.7 Patch 4) and Aruba Wireless AP (IAP) to perform 802.1x EAP-FAST (machine + user) authentication followed by Posture Assessment on Windows 10 Machines (installed with AnyConnect 4....