VPN ASA 5505 + PAT on the same public IP Address

[Diego Rigorini]

I'm a newbie in Cisco configuration and I face a problem.

I have 2 ASA 5505 in two different branches. A VPN is established.

On the second branch I have only 1 public static IP that is used for the outside address of the ASA.

I need to make a PAT to publish the www port of a server but if I try to config the PAT I receive the error that say I can't do it because there is an address overlap with the outside address.

I cannot upgrade to a subnet of 8 IP.

There is a way to accomplish that keeping my VPN up?

[Marvin Rhoads]

When you say VPN do you mean a remote access SSL VPN? By default that uses port 443 but you can change it to some other port and thus free up 443 for your web server.

Instructions for doing that can be found here:

https://www.cisco.com/c/en/us/support/docs/security/adaptive-security-device-manager/118842-technote-asdm-00.html#anc10

[Diego Rigorini]

No, it's a site-so-site IPSec VPN established between two branches.
The ports I need are not used by any service actually.
This is the configuration of the outside interface

interface Vlan2
nameif outside
security-level 0
ip address 83.xx.xx.221 255.255.255.255
!

I tried the following

Object network mytest
nat (inside,outside) static 83.xx.xx.221 service tcp www www

And I get the error

ERROR: Address 83.xx.xx.221 overlaps with outside interface address.
ERROR: NAT Policy is not downloaded

How can I do it without breaking my VPN?

[GioGonza · Accepted solution]

Hello @Diego Rigorini,

In order to make it work, you need to use the keyword "Interface" since if you don´t the ASA will think this is a new IP address and when it checks it finds is the same as the outside interface, that´s why you have the error, change it for this: 

Object network mytest
nat (inside,outside) static interface service tcp www www

HTH

Gio

[Diego Rigorini]

It works!

Thank you very much.