VPN between PIX and a NAT'd router behind a linksys cable/dsl router

[Robert Milanovich]

Can a VPN be created between a PIX and a 2600 series router that is behind a linksys cable/dsl modem? The 2600 router is behind some form of NAT being done at the linksys. My first instinct it to have them give the 2600 a public IP and place it in parallel to the linksys, but I would like to know if it's possible to work around the NAT problem. Or, should I do another type of tunnel that won't be susceptable to the NAT problem?

[gfullage]

If you're able to build a static one-to-one address translation on the LinkSys that maps to teh 2600 then yes, this should work fine, just point the peer address on the PIX to the NAT'd address in the LinkSys.

If the 2600 is on a private network behind the LinkSys and the LinkSys only does PAT, then no, it won't work and you'll have to put the 2600 in parallel and give it a valid routable address.