VPN to Vendor who only allows public IP addresses

[jjames1905]

I need to establish a VPN to a vendor who will only allow public IP address across a VPN.  I need to keep the public IP address out of my LAN for security policy reasons.  I am using a ASA 5510 with 8.2(1) which is connected to the a DMZ port on my 3845 Router.  My main firewall is configured on this 3845 router.  The ASA firewall does have its own outside internet connection sepereate from the 3845 router/firewall.

This issues is to connect the vendor's server (a public IP address) to my internal server ( RCF-1918 IP address) without having to rout the public IP address across my LAN. My only solution now is to try a double NAT on the ASA and the  router DMZ at this time.

Ideas?

[Jennifer Halim]

Sorry, can you please share a topology diagram on how the ASA and the router is connected, as well as which device is terminating the VPN? and lastly how is your internal server connected?

[jjames1905]

The inside interface of the ASA firewall is connected to a DMZ port on the 3845 router/firewall. The VPN will terminate on the ASA firewall.  My internal server is at a remote location and connected to the 3845 router/firewall via a internal MPLS to that remote location.

In addition, the vendor will not allow the RFC-1918 IP address for my server to route across the VPN.  They only except public IP addresses for routing to their server.

[Jennifer Halim]

Yes, you can configure the NAT on the ASA. Crypto ACL then needs to match the NATed address.

How many of your internal host needs to access the vendor server? Also, does the vendor server need to access your internal server?

You can configure NAT for your internal host when the destination subnet is your vendor server.

[jjames1905]

only one of my servers need to access the vendor server and the same vendor server needs to access my server.

[Jennifer Halim · Accepted solution]

OK, then you would need to configure static NAT.

Do you already have a static NAT configured for your internal server?

If not, then just create static NAT with ACL as follows:

access-list static-server permit ip host host

static (inside,outside) access-list static-server

For the crypto ACL:

access-list crypto-acl permit ip host host

[jjames1905]

So we NAT the public IP from the vendor to a private address on our network and route to our server.

Then we NAT our server IP to a public IP routed back to the vendor server.

[Jennifer Halim]

Yes, absolutely correct.