VPN doubt

[Network Pro]

Hi,

i have configured a l2l tunnel on my side. yet to configured on the other side. just wondering will i be able to see anything if i do

sh crypto isakmp sa? (will there be any entries)?

also do i have to exempt NAt on the inside interface? if i dont then what would happe (sorry bit confised) - both firewal are on the same LAN - just want to create an encrypted tunnel

Thanks

[Jennifer Halim]

You won't be able to see any output if you do "sh crypto isakmp sa" until the IPSec VPN phase 1 gets established.

You would need to send traffic through the tunnel to initiate the VPN tunnel.

If you see "MM_ACTIVE" or "QM_IDLE" from the "sh crypto isakmp sa" output, that means phase 1 is established.

The crypto ACL that you configure needs to match the clear text traffic (ie: traffic that you would like to encrypt), so whether it's being NATed or being exempted from NAT, it needs to match.

If you don't want to perform any NATing, then yes, you would need to configure NAT exempt.

[Network Pro]

thanks for the reply..

1. when you say the crypto acl needs to match..do you mean ip address range allowed on 1 side needs to match the other

ex:

ip access-list abc extended permit ip host 10.10.10.10  10.10.20.0 255.255.255.0

shoud their side be

ip access-list abc extended permit ip 10.10.20.0 255.255.255.0 host 10.10.10.10

if for example, will this work:

ip access-list abc extended permit ip host 10.10.10.10  10.10.20.0 255.255.255.0

ip access-list abc extended permit ip host 10.10.10.100  10.10.20.0 255.255.255.0

shoud their side be

ip access-list abc extended permit ip 10.10.20.0 255.255.255.0 host 10.10.10.10

or does an access list is needed to allow 10.10.10.100 to get the tunnel up ?

also if i dont nat exempt then whats the default ?

Thanks

[Jennifer Halim]

When i say crypto acl needs to match, I mean that if you are NATing your traffic, then the crypto ACL needs to match on the NATed address/subnet, and if you don't NAT, then crypto ACL needs to match the real ip subnet.

Your statement is also correct, you would also need to configure mirror image ACL on both end of the tunnel:

- If you have 2 lines of ACL on one side, the other side also needs to have 2 mirrored lines of ACL:

Eg:

Side-A:

ip access-list abc extended permit ip host 10.10.10.10  10.10.20.0 255.255.255.0

ip access-list abc extended permit ip host 10.10.10.100  10.10.20.0 255.255.255.0

Side-B:

ip access-list abc extended permit ip 10.10.20.0 255.255.255.0 host 10.10.10.10

ip access-list abc extended permit ip 10.10.20.0 255.255.255.0 host 10.10.10.100

For NAT exemption, it really depends on what is currently configured on your firewall, and whether there is any other NATing configured on the firewall.

[Network Pro]

there is nating configured on the firewall but that just for different subnet. not the ones for lan to lan tunnel.

there is also a dynamic NAT  which says any to any on the outside interface ? - which i take it as its NATing any address from inside to outside address (10.10.10.10) - is it correct ?

Thanks

[Jennifer Halim]

If you have an existing nat statement on an interface, then you would need to configure NAT exemption if you don't want to NAT the traffic.

What version of firewall are you running? because depending on which version the syntax is different.

[Network Pro]

version 7.2

my confusion is i dont want to NAT the traffic as i still want them to access our network from 10.10.20.20 address...but just wondering if dont give a exempt NAT then will it NAT by default ?

also what does this statment do ?

nat dyanamic any (inside) any (outside) on the outside interface?

Thanks

[Jennifer Halim]

If you don't want to NAT, then just configure NAT exemption.

Here is the sample configuration:

access-list nonat permit ip

nat (inside) 0 access-list nonat

I never actually see any command as stated:

nat dyanamic any (inside) any (outside) on the outside interface

Is this configuration on PIX or ASA version 7.2?

it should be something like this:

nat (inside) 1 0 0

global (outside) 1 interface

[Network Pro]

yes thats correct, i just expanded the statement

global (ouside) interface means ? does it mean any ip address will get NATed as the outside address?

Thanks

[Jennifer Halim]

NAT statement is the command that determine which source subnet/ip address needs to be NATed:

nat (inside) 1 0 0

"0 0" basically means anything coming through from inside interface needs to be NATed.

The the Global statement means what IP Address it gets NATed to.

global (outside) 1 interface

means that it will get NATed to the outside interface ip address of the firewall

Nat and global statement comes in a pair with the sequence number.

From the above example, the sequence is 1 so those are the nat/global pair

Traffic coming from inside interface will get NATed to outside interface ip address.

[Network Pro]

thanks i have understtood now.

in my example, we are using internal addressing but outside firewall address or peer address is different

(We are using 172.16.x.x range inside and outside address of firewall is 10.x.x.x range but the other side are jut using 10.x.x.x range for their firewall and internal as well) - which means i will have to NAT my side and they dont have to ? isnt it ? please correct me if  i am wrong..also i dont NAT my side, will it still work ? (as my address will go outside as 172.16.x.x range)

Thanks

[Jennifer Halim]

I am assuming that you would like to encrypt traffic from 172.16.x.x range from your inside, towards the remote subnet, ie: 10.x.x.x, right?

If this is the case, then you would need to configure the following:

access-list nonat permit ip 172.16.x.x 10.x.x.x

nat (inside) 0 access-list nonat

The above statement is to configure NAT exemption, ie: not NATing the traffic.

[Jennifer Halim]

Here is a sample configuration:

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080950890.shtml

Hope this helps.