help with NAT in a VPN

[515user]

I have a VPN established to another IPSEC device without NAT
partial PIX config is ver 6.1
nat (inside) 0 access-list 101
access-list 101 permit ip 192.168.1.0255.255.255.0 192.168.2.0 255.255.255.0

where 192.168.1.0 is the subnet on the inside of the PIX

how do i NAT a the 192.168.1.0 range to a 172.16.3.0 range
and pass this in the VPN to 192.168.2.0

thanks in advance

 

[Iota]

adding the line:
nat (inside) 1 0.0.0.0 0.0.0.0
will NAT everything on the inside interface
out, EXCEPT, traffic destined to 192.168.2.0 since
that is explicitly turned off in your nat (inside) 0
statement.

You will also have to have a global statement as well
to give it an IP to NAT/PAT on.

i.e. Global (outside) 1 <Diff IP of PIX/IP Range>

Iota

 

[515user]

Iota,
Could you elaborate
I want to NAT my 192.168.1.0/24 to 172.16.2.0/24 when destined ONLY 192.168.2.0 through the VPN
all encrypted traffic through the VPN for 192.168.2.0 should be as source of 172.16.2.0( not 192.168.1.0)

thanks

 

[Iota]

To the best of my knowledge, it cannot be done that way on the PIX.

NATing takes place when going from a higher to lower access interface and through a VPN, that doesn't occur. Furthermore, you can only have 1 Address Space for your global nat. i.e You cannot NAT to 1 address in subnet A for certain IPS and NAT to another ip address in a subnet B for other IPs. In order to create a 1-1 correspondance, you'd have to create Static mappings, and again, static mappings only work between two interfaces of different access levels--more specifically, traffic traveling from a lower access level to a higher access level.

You would probably have better luck doing it on a router before getting to the PIX/VPN tunnel.

Just curious, but why do you want to NAT througha VPN tunnel when the two sides are on different subnets? Maybe there is a better solution to the problem if you can explain the problem in more details.

Iota

 

[515user]

Iota,
I have 2 sites with the same internal subnets and was hoping could overcome this by NATing one subnet when going through the VPN.
I was able to accomplish this by replacing one pix with a a 2600 router running IOS 12.1

I was hoping that the PIX could provide me the same NAT features
thanks again

 

[yizhar]

HI.

A network diagram will help understanding the issue here.

Anyway, if I get it right, then why not use the registered external (GLOBAL 1) address also for VPN traffic?
That way you don't need nat 0, and you don't have a problem of address conflict if you have a STATIC mapping at the other side for the server you need access to.

Bye
Yizhar Hurwitz

http://come.to/yizhar

http://teachers.sivan.co.il/yizhar

 

[515user]

thanks for all your inputs.Here is the setup

LAN(192.168.1.0)-->FW(not a PIX)-->WAN(209.x.x.1)----> 208.x.x.1(WAN)<--PIX<-- LAN (192.168.1.0)

If NAT is not possible on the PIX ,maybe I should try NAT on the other end