asked on

You need a route map before you can apply the NAT translations. This prevents the traffic from LAN1 -> LAN2 from being NAT'ted prior to being encapsulated/encrypted.

access-list 120 deny ip 10.0.1.0 0.0.0.255 10.0.2.0 0.0.0.255
access-list 120 permit ip 10.0.1.0 0.0.0.255 any
route-map route_map_to_avoid_natting_vpn_traffic permit 1
match ip address 120
exit
ip nat inside source route-map route_map_to_avoid_natting_vpn_traffic ... bla... bla... bla...

I dont want to look into your ip nat inside rule too much with your 'custom' pools. but I expect you want to replace these three lines with the following lines:

------------------------
ip nat inside source static tcp 192.168.1.1 3389 interface Dialer0 3389
ip nat inside source list 101 interface Dialer0 overload
ip nat inside source list 105 interface Dialer0 overload
------------------------
ip nat inside source static tcp 192.168.1.1 3389 interface Dialer0 3389
ip nat inside source list 106 interface Dialer0 overload
access-list 101 deny ip 192.168.1.0 0.0.0.255 10.10.0.0 0.0.255.255
access-list 101 permit ip 192.168.1.0 0.0.0.255 any

basicly, how ever you fix it, the underlying problem is that your traffic is doing this on the outbound interface dialer 0 in the following order:

1: nat traffic which matches acl 101
2: encrypt traffic which matches CAL (AKA access-list 104)

since by the time the traffic hits number 2 it's being NAT'ed, the ACL for 104 does not correctly "permit from 192.*.*.* to 10.*.*.*".

ASKER CERTIFIED SOLUTION

asdlkf

membership

This solution is only available to members.

To access this solution, you must be a member of Experts Exchange.

Start Free Trial

NutrientMS

ASKER

That worked spot on! Thanks for your help and for clearing that up for me. On a separate issue, now on the ASA side, if I wanted to restrict their access to certain parts of our network, can I create an ACL for that particular network, or would I do it as part of the IPSec ACL (eg. set it to deny, therefore not encrypting the traffic and stopping the flow.)

My ASA config for the Branch office VPN looks like (and is working for full access between the networks):
access-list inside_nat0_outbound line 4 extended permit ip 10.10.0.0 255.0.0.0 192.168.1.0 255.255.255.0
nat (inside) 0 access-list inside_nat0_outbound
access-list outside_cryptomap_30 extended permit ip 10.10.0.0 255.255.0.0 192.168.1.0 255.255.255.0
crypto map outside_map 30 set connection-type bidirectional
crypto map outside_map 30 set peer <branch peer ip>
crypto map outside_map 30 match address outside_cryptomap_30
crypto map outside_map 30 set transform-set ESP-3DES-SHA
crypto map outside_map 30 set security-association lifetime seconds 28800 kilobytes 4608000
no crypto map outside_map 30 set nat-t-disable
no crypto map outside_map 30 set reverse-route
crypto map outside_map 30 set phase1-mode main
crypto map outside_map 30 set inheritance rule
crypto map outside_map interface outside

So say I had a server at 10.10.1.1 that I didn't want them to access, would I create an ACL for inbound from my Outside interface?
access-list outside_access_in extended deny ip 192.168.1.0 255.255.255.0 10.10.1.1 255.255.255.255
and apply that inbound on the outside interface?
?

Thanks guys.

Site to Site VPN between Cisco ASA 5510 and 857 Router