Site-to-site VPN & NAT
Posted on 2003-12-03
I have two networks (A & B) which using completely different IP range. e.g.
Network A range: 220.127.116.11 255.255.255.0
Network B range: 18.104.22.168 255.255.255.0
I want to have site-to-site VPN to be configured. Traffic flow is initiated from A to B.
The requirement is:
The source address from network A must be translated (NAT) to network B range before it enters VPN tunnel.
On PIX-A, I know I can configure NAT to translate the source destination from 22.214.171.124/24 to 126.96.36.199/24 range. I can then specify the traffic for this VPN using access-list (e.g. access-list 100 permit ip 188.8.131.52 0.0.0.255 184.108.40.206 0.0.0.255)
I'm not sure as for the sequence of operation on Cisco PIX.
Which one will be performed first? NAT or VPN? is there a way to specify the order of operation?
If NAT is performed first, then the method I described above will work.
On the other hand, if VPN is performed first, I don't know how to translate the source address.