VPN with private IP on external interface

[huwyhuwy123]

Hi there,

We'd to setup a site-site VPN between 2 ASA 5505s. The problem is that one of them is in a serviced office and has a private IP address on the external interface. The office company provides a 1-1NAT from one of their public IPs to the private IP (on the external interface of the ASA).

Obviously there will be a problem forming the tunnel to a private IP. Can you think of a way around this?

Cheers,

Huw

[Federico Coto Fajardo]

Hi there,

Indeed a VPN tunnel must be established between public IPs (if going through the Internet).

If the ASA at one side has a private IP, but the ISP provides a one-to-one static NAT, then you can terminate the tunnel at the public IP (NATed IP).

The requirement is that the ISP must redirect all traffic to your private IP (as it will do if having a static NAT).

Hope it helps.

Federico.