Site-to-site VPN & NAT
Posted on 2003-12-03
I have two networks (A & B) which using completely different IP range. e.g.
Network A range: 184.108.40.206 255.255.255.0
Network B range: 220.127.116.11 255.255.255.0
I want to have site-to-site VPN to be configured. Traffic flow is initiated from A to B.
The requirement is:
The source address from network A must be translated (NAT) to network B range before it enters VPN tunnel.
On PIX-A, I know I can configure NAT to translate the source destination from 18.104.22.168/24 to 22.214.171.124/24 range. I can then specify the traffic for this VPN using access-list (e.g. access-list 100 permit ip 126.96.36.199 0.0.0.255 188.8.131.52 0.0.0.255)
I'm not sure as for the sequence of operation on Cisco PIX.
Which one will be performed first? NAT or VPN? is there a way to specify the order of operation?
If NAT is performed first, then the method I described above will work.
On the other hand, if VPN is performed first, I don't know how to translate the source address.