Cisco PIX: Configuring NAT for One VPN Connection

lrmoore,

Thanks for your response. I'd tried to incorporate your solution.

Here is my current configuration. It's currently not working.

---------------------------------------------------------

name 192.168.1.20 server
name 165.20.25.196 customer
name 192.168.218.157 nataddress
access-list inside_outbound_nat0_acl permit ip host nataddress host customer
access-list outside_cryptomap_20 permit ip host nataddress host customer
global (outside) 20 nataddress
nat (inside) 0 access-list inside_outbound_nat0_acl
nat (inside) 20 access-list inside_outbound_nat0_acl 0 0
nat (inside) 10 local_network 255.255.255.0 0 0
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 165.20.52.37
crypto map outside_map 20 set peer server
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key presharedkey address 165.20.52.37 netmask 255.255.255.255 no-xauth no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

---------------------------------------------------------

Also... my PDM isn't working any longer. It says that PDM does not support "policy NAT" command in your configuration.

What does that mean?

lrMoore,

We've made some progress.

Here is my current configuration:

----------------------------------------------------------

name 192.168.1.20 server
name 165.20.25.196 customer
access-list outside_cryptomap_20 permit ip host 192.168.212.15 host customer
access-list nat_to_customer permit ip host server host customer
global (outside) 20 192.168.212.15
nat (inside) 20 access-list nat_to_customer 0 0
crypto ipsec transform-set ESP-3DES-MD5 esp-3des esp-md5-hmac
crypto map outside_map 20 ipsec-isakmp
crypto map outside_map 20 match address outside_cryptomap_20
crypto map outside_map 20 set peer 165.20.25.196
crypto map outside_map 20 set transform-set ESP-3DES-MD5
crypto map outside_map interface outside
isakmp enable outside
isakmp key presharedkey address 165.20.25.196 netmask 255.255.255.255 no-xauth no-config-mode
isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

----------------------------------------------------------

My PDM Log shows this:

Built Dynamic TCP translation from inside:192.168.1.20/32824 to outside(nat_to_customer):192.168.212.15/1028
Built outbound TCP connection 5 for outside:165.20.25.196/5500 (165.20.25.196/5500) to inside:192.168.1.20/32824(192.168.212.15/1028)

----------------------------------------------------------

When I enable #debug crypto isakmp and #debug crypto ipsec, I see this:

IPSEC(sa_initiate): ACL = deny; no sa created
IPSEC(sa_initiate): ACL = deny; no sa created

----------------------------------------------------------

What do you suggest?

Can you post result of
sho access-list
sho cry is sa
sho cry ip sa

Results of #sho access-list

access-list cached ACL log flows: total 0, denied 0 (deny-flow-max 1024)
            alert-interval 300
access-list outside_cryptomap_20; 1 elements
access-list outside_cryptomap_20 line 1 permit ip host 192.168.212.15 host customer (hitcnt=38)
access-list nat_to_customer; 1 elements
access-list nat_to_customer line 1 permit ip host server host customer(hitcnt=13)

------------------------------------------------------------------

Results of #sho cry is SA

Total     : 0
Embryonic : 0
        dst               src        state     pending     created

------------------------------------------------------------------

interface: outside
    Crypto map tag: outside_map, local addr. 66.66.66.66

   local  ident (addr/mask/prot/port): (server/255.255.255.255/0/0)
   remote ident (addr/mask/prot/port): (customer/255.255.255.255/0/0)
   current_peer: 198.198.198.198:0
     PERMIT, flags={origin_is_acl,}
    #pkts encaps: 0, #pkts encrypt: 0, #pkts digest 0
    #pkts decaps: 0, #pkts decrypt: 0, #pkts verify 0
    #pkts compressed: 0, #pkts decompressed: 0
    #pkts not compressed: 0, #pkts compr. failed: 0, #pkts decompress failed: 0
    #send errors 0, #recv errors 0

     local crypto endpt.: 66.66.66.66, remote crypto endpt.: 198.198.198.198
     path mtu 1500, ipsec overhead 0, media mtu 1500
     current outbound spi: 0

     inbound esp sas:


     inbound ah sas:

             
     inbound pcp sas:
             
             
     outbound esp sas:
             
             
     outbound ah sas:
             
             
     outbound pcp sas:

------------------------------------------------------------------

I'm thinking the problem is on the remote side? What you think?

Results of #sho cry is sa

Total     : 1
Embryonic : 1
        dst               src        state     pending     created
   198.198.198.198    66.66.66.66    MM_NO_STATE   0           0

------------------------------------------------------------------

local  ident (addr/mask/prot/port): (nataddress/255.255.255.255/0/0)

------------------------------------------------------------------

crypto map outside_map 20 match address outside_cryptomap_20 is still present.

>  MM_NO_STATE  
Failing phase 1 ISAKMP negotiation.
  QM_IDLE is what you're looking for

Possible pre-shared key mismatch. Suggest setting up a new key on both ends. They must match exactly  
Make sure other end policy matches yours....

isakmp policy 20 authentication pre-share
isakmp policy 20 encryption 3des
isakmp policy 20 hash md5
isakmp policy 20 group 2
isakmp policy 20 lifetime 86400

Other end must match exact, but the [20] can be any number...

Actually, there was a network configuration on my side and now I'm able to get the VPN up.

  198.198.198.198    66.66.66.66    QM_IDLE   0           0

Thank you for getting me through this configuration. I really appreciate your assistance.