Cisco PIX VPN / NAT question 1

[jwcatwork]

I have a Cisco PIX 501 (Version 6.3) and have created a VPN for remote access. Once connected, the client DHCP pool is 10.1.1.1-254. The inside address of the PIX is 192.123.123.225 and the outside address is 67.123.123.27. Once connected to the VPN, all internal hosts see the ip address of the VPN client in the 10.1.1.X range. How would I use NAT to make the VPN hosts appear to be coming from the internal 192.123.123.225 address instead of their VPN address when communicating with other hosts on the internal LAN?

 

[jarmand]

Take this advice with a grain of salt. I don't *know*... but as this has sat for a while, I'll take a shot.

Does the VPN terminate at the PIX? If so, I'm not sure if it would even be possible to do what you ask. However, according to Cisco:
"Starting with PIX Firewall Version 6.2, NAT and PAT can be applied to traffic from an outside or less secure interface to an inside (more secure) interface."

http://www.cisco.com/en/US/docs/security/pix/pix63/configuration/guide/bafwcfg.html#wp1113519Using

Outside NAT

Therefore:

nat (outside) 1 10.1.1.0 0.0.0.255
global (inside) 1 interface

Does this work?

 

[brianinms]

Perhaps you could tell us what you are trying to accomplish. Why do you want the addresses to appear different than they are?

 

[jwcatwork]

jarmand, that was exactly the command I needed, it worked like a charm! Thanks a million!

brianinms, what I have is a 3rd party server which I wanted access to over VPN. They wouldn't let us access it over VPN unless we buy their VPN solution, which is expensive. I took an old PIX 501, set it up on our network, and now, with a little NAT magic, their access control list thinks it is a client on our internal network trying to access it, instead of the different IP range of our VPN clients. Thanks for the help guys!