Nat inside VPN Tunnel with Pix 1

[Maxwell2005]

Hy,

i have the follwing problem. Between two of our customers we have a VPN Tunnel built up.
Customer A has an official IP adresses from his provider which is say 172.0.0.0
So his internal LAN gets Natted to this number.
Customer B needs Customer A to arrive inside the VPN with another IP-Adress.

So is it possible to configure a "second" NAT which only is used inside a specific VPN tunnel ?
And if yes could you please post some example config lines how this works ?

Thanks for your help

Maxwell

 

[Maxwell2005]

To make my above post a bit clearer as it seems to me now:

Customer A private IP in LAN 172.0.0.0
Cusotmer A official IP Outside (Nat 1) 196.0.0.0
Customer A in VPN to Customer B (Nat 2) 121.0.0.0

I have no idea how to configure the Nat 2

Maxwell

 

[ChrisAC]

I posted this today in comp.dcom.sys.cisco.

You can NAT to a different address using a NAT and Global that matches an
ACL. For example,

If your external address was 1.2.3.4 but you wanted to NAT traffic from the
192.168.204.0 /24 network going to 10.20.30.40 global address over a VPN to
1.2.3.5 then you would do something like;

access-list jiggypuff permit ip 192.168.204.0 255.255.255.0 host 10.20.30.40

nat (inside) 2 access-list jiggypuff
global (outside) 2 1.2.3.5 - 1.2.3.5

You might also have something like;

nat (inside) 1 192.168.204.0 255.255.255.0
global (outside) 1 interface.

So traffic going out to the internet would be NATed to the outside pix
addres (1.2.3.4) and traffic going over the VPN to 10.20.30.40 would be
NATed to 1.2.3.5.

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[Gungnir77]

Also be aware that if you need to implement a VPN tunnel using a NATed address you need to configure NAT-Traversal, (UDP over IPSec) to get traffic to work

Gungnir77
CCNP, Advanced Security team at Cisco TAC

 

[ChrisAC]

Gungnir,

What's the command to configure that? I presume that it must be on by default as I configured a VPN using NAT last week and didn't have to configure NAT-T.

Thanks,

Chris.

**********************
Chris A.C, CCNA, CCSA
**********************

 

[sbaldwin22]

NAT is not the same as NAT-T. NAT Traversal is also disabled by default. This will turn it on:

isakmp nat-traversal 20

<20> is the nat keepalive, set it higher or lower as you desire.