cancel
Showing results for 
Search instead for 
Did you mean: 
cancel
Announcements
667
Views
0
Helpful
4
Replies
Diego Rigorini
Beginner

VPN ASA 5505 + PAT on the same public IP Address

I'm a newbie in Cisco configuration and I face a problem.

 

I have 2 ASA 5505 in two different branches. A VPN is established.

 

On the second branch I have only 1 public static IP that is used for the outside address of the ASA.

I need to make a PAT to publish the www port of a server but if I try to config the PAT I receive the error that say I can't do it because there is an address overlap with the outside address.

I cannot upgrade to a subnet of 8 IP.

There is a way to accomplish that keeping my VPN up?

 

 

 

1 ACCEPTED SOLUTION

Accepted Solutions

Hello @Diego Rigorini,

 

In order to make it work, you need to use the keyword "Interface" since if you don´t the ASA will think this is a new IP address and when it checks it finds is the same as the outside interface, that´s why you have the error, change it for this: 

 

Object network mytest
nat (inside,outside) static interface service tcp www www

 

HTH

Gio

View solution in original post

4 REPLIES 4
Marvin Rhoads
VIP Community Legend

When you say VPN do you mean a remote access SSL VPN? By default that uses port 443 but you can change it to some other port and thus free up 443 for your web server.

 

Instructions for doing that can be found here:

 

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/118842-technote-asdm-00.html#anc10

No, it's a site-so-site IPSec VPN established between two branches.
The ports I need are not used by any service actually.
This is the configuration of the outside interface

interface Vlan2
nameif outside
security-level 0
ip address 83.xx.xx.221 255.255.255.255
!

I tried the following

Object network mytest
nat (inside,outside) static 83.xx.xx.221 service tcp www www

And I get the error

ERROR: Address 83.xx.xx.221 overlaps with outside interface address.
ERROR: NAT Policy is not downloaded

How can I do it without breaking my VPN?

Hello @Diego Rigorini,

 

In order to make it work, you need to use the keyword "Interface" since if you don´t the ASA will think this is a new IP address and when it checks it finds is the same as the outside interface, that´s why you have the error, change it for this: 

 

Object network mytest
nat (inside,outside) static interface service tcp www www

 

HTH

Gio

View solution in original post

It works!

 

Thank you very much.

Content for Community-Ad