- Posts: 2
- Thank you received: 0
ASA 5505 - site to site VPN and PAT IP
15 years 4 months ago #31047
by ck1
ASA 5505 - site to site VPN and PAT IP was created by ck1
Hello all, I am a little stumped and could use a hand!
Here is our network design
img190.imageshack.us/img190/1006/vpnconcept.jpg
I had a pretty good sample configuration of exactly what we want (LAN-to-LAN Tunnel Between ASA 5505 and ASA/PIX) here
www.cisco.com/en/US/products/ps6120/prod...186a0080950890.shtml
But the Main office IT group wants us to PAT our private IPs to a single IP (10.70.4.70) for the tunnel. How would I incorporate that with the above configuration? I tried several ways
nat (inside) 1 192.168.1.1 255.255.255.0
global (outside) 1 10.70.4.70
but then I couldn't figure out how to route to the internet from there. Also, I don't know if it's better to PAT to that IP all the time, or only for the tunnel.. is there a cost/benefit in performance?
Appreciate any help you can give!
Here is our network design
img190.imageshack.us/img190/1006/vpnconcept.jpg
I had a pretty good sample configuration of exactly what we want (LAN-to-LAN Tunnel Between ASA 5505 and ASA/PIX) here
www.cisco.com/en/US/products/ps6120/prod...186a0080950890.shtml
But the Main office IT group wants us to PAT our private IPs to a single IP (10.70.4.70) for the tunnel. How would I incorporate that with the above configuration? I tried several ways
nat (inside) 1 192.168.1.1 255.255.255.0
global (outside) 1 10.70.4.70
but then I couldn't figure out how to route to the internet from there. Also, I don't know if it's better to PAT to that IP all the time, or only for the tunnel.. is there a cost/benefit in performance?
Appreciate any help you can give!
15 years 4 months ago #31052
by ck1
Replied by ck1 on topic Re: ASA 5505 - site to site VPN and PAT IP
hmm well i give up
15 years 3 months ago #31119
by r0nni3
Currently working as Cisco Engineer at Neon-Networking.
Certifications:
CCNA - Have it
CCNA Security - Have it
CCSP - Almost!!!!
CCIE Security - Not so far away dream
Replied by r0nni3 on topic Re: ASA 5505 - site to site VPN and PAT IP
[code:1]access-list vpn-nat permit ip 192.168.1.0 255.255.255.0 10.1.130.0 255.255.255.0
!
static (inside,outside) 10.70.4.70 access-list vpn-nat
!
access-list vpn-data permit ip host 10.70.4.70 10.1.130.0 255.255.255.0[/code:1]
Hope this helps
This way you can make your L2L tunnel and still have a connection to the internet since the destination addresses of the internet are out side of the private IP ranges.
I have to warn you tho. Using this setup might cause problems with the stability of the VPN.
!
static (inside,outside) 10.70.4.70 access-list vpn-nat
!
access-list vpn-data permit ip host 10.70.4.70 10.1.130.0 255.255.255.0[/code:1]
Hope this helps
This way you can make your L2L tunnel and still have a connection to the internet since the destination addresses of the internet are out side of the private IP ranges.
I have to warn you tho. Using this setup might cause problems with the stability of the VPN.
Currently working as Cisco Engineer at Neon-Networking.
Certifications:
CCNA - Have it
CCNA Security - Have it
CCSP - Almost!!!!
CCIE Security - Not so far away dream
Time to create page: 0.127 seconds