Solved

NAT'ing on two WAN interfaces with VPN

Posted on 2008-06-19
4
201 Views
Last Modified: 2010-04-21
I'm having a NAT problem with an ASA5510 (v7.1(2).

Currently there is one T1 which hits a router and is then connected to the ASA.  I set it up a year ago and it's been working fine.

The outside address is 67.x.x.228 and is a target for several VPN clients.
The current static route is 'route outside 0.0.0.0 0.0.0.0 67.x.x.225 1'
The current NAT commands are:
global (outside) 10 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 10 0.0.0.0 0.0.0.0
There is no DMZ
The only access-list is 'access-list inside_nat0_outbound extended permit ip any 10.80.104.0 255.255.255.0 ' (these internal numbers are the VPN pool addresses)

All of this works well. Standard Stuff.  The VPN is a split tunnel and works OK too.

Now they added a cable line, want to move all traffic (except MX) to the new interface, and keep the VPN and outbound MX traffic on the original interface.  The new line has a gateway address of 75.x.x.22 (numbers IP and gateway given me by comcast)

Note: Their email is hosted off-site on an Exchange Server IP 207.x.x.x

So:

I created another outside interface called 'outside_comcast' with a security level of 5 and an IP of 75.x.x.21

I changed the old static route to 'route outside 207.x.x.x 255.255.255.255 67.x.x.225' (static route to MX server thru old interface)

I created a new static route 'route outside_comcast 0.0.0.0 0.0.0.0 75.x.x.22' (default route now on new line)

I tweaked the old NAT command to 'nat (inside) 10 207.x.x.152 255.255.255.255' (10 is a single address (outside interface) pool)

I created a new NAT command to 'nat (inside) 11 0.0.0.0 0.0.0.0' (11 is a single address (outside_comcast interface) pool)

I have a 'global (outside_comcast) 11 interface command

My relevant commands look like this now:

global (outside) 10 interface
global (Outside_Comcast) 11 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 11 0.0.0.0 0.0.0.0
nat (inside 10 207.5.72.153 255.255.255.255
route outside 207.x.x.153 255.255.255.255 67.132.35.255
route Outside_Comcast 0.0.0.0 0.0.0.0 75.x.x.22 1

Result:

Internet, etc works fine.  MX clients can sync up.  All good.
But I lose VPN.  It's like the 'outside' interface no longer exists.  I don't think its VPN config, cuz I can no longer ping the 'outside' interface (from the outside) and I could before the change.  I can ping it from the ASA, and I can 'extended ping' from that 'outside' interface to the MX server.

I've tried a lot of tweaks, but I'm missing something basic in NAT'ing.
0
Comment
Question by:handgunowner
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
  • 2
4 Comments
 
LVL 15

Expert Comment

by:Voltz-dk
ID: 21833400
>nat (inside) 10 207.x.x.152 255.255.255.255
This doesn't serve any purpose.

No, the outside interface no longer exists - becuz you have no routing on it anymore.  It only knows how to "talk" to the MX, nothing else.
0
 

Author Comment

by:handgunowner
ID: 21845767
I only want to do inbound VPN (and outbound MX) on this interface.  So what would be the routing solution?
0
 
LVL 15

Accepted Solution

by:
Voltz-dk earned 500 total points
ID: 21848304
I assume these are remote access VPNs though, that can log from anywhere.  So you'd need routing to all the Internet.  You'd need something like policy-based routing (PBR), but you can't do that on the ASA.

If you are in control of the router with IP 67.x.x.225, you might be able to add some NAT there.  But it'd likely put several limitations on the VPN connectivity you get.
It might only work with TCP encapsulation, and access will likely only be inbound from clients.

Otherwise you need some fancy routing, maybe with VRFs, but that's not something I'm an expert on.
0
 

Author Closing Comment

by:handgunowner
ID: 31468938
I discovered this today by playing with an extra ASA I had here.  The freakin' ASA doesn't have the policy routing support your average PIX has.  I'm going to contact Cisco and see if I can get a workaround.  Thanx
0

Featured Post

Flexible connectivity for any environment

The KE6900 series can extend and deploy computers with high definition displays across multiple stations in a variety of applications that suit any environment. Expand computer use to stations across multiple rooms with dynamic access.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

This article will cover setting up redundant ISPs for outbound connectivity on an ASA 5510 (although the same should work on the 5520s and up as well).  It’s important to note that this covers outbound connectivity only.  The ASA does not have built…
Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …
As a trusted technology advisor to your customers you are likely getting the daily question of, ‘should I put this in the cloud?’ As customer demands for cloud services increases, companies will see a shift from traditional buying patterns to new…

734 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question