site to site VPN, with VPN users coming in on the same outside interface, NAT

[mdschofield]

Hey guys,

I'm super new - I completely apologize.  I'll try to describe my problem, let me know if I need to provide any additional information.

I inherited a 5510 with 8.2.5 on it, writing the config to upgrade to current (and thus, going through the 8.3 code changes)

The device is currently set up with a site to site tunnel to one of our other sites on the OUTSIDE interface.

It also accepts VPN users on the OUTSIDE interface.

VPN users need to be able to have connectivity to devices on the INSIDE interfaces as well as our other sites on the OUTSIDE interface.

Do I write separate NAT statements for both the vpn users for both inside, and outside?   

Example:

nat (outside,inside) source static VPNUSERS VPNUSERS destination static INSIDESTUFFS INSIDESTUFFS

nat (outside,outside) source static VPNUSERS VPNUSERS destination static OUTSIDESTUFFS OUTSIDESTUFFS

Thanks for your insight.

[Rahul Govindan]

Yes, since your destination is on different interfaces your usage of 2 NAT statements is correct.

You can collapse it to one statement if you use "any" as the destination interface and use the "route-lookup" keyword at the end of the NAT statement so that the egress interface is chosen based on routing table.