Solved

NAT'ing on two WAN interfaces with VPN

Posted on 2008-06-19
4
197 Views
Last Modified: 2010-04-21
I'm having a NAT problem with an ASA5510 (v7.1(2).

Currently there is one T1 which hits a router and is then connected to the ASA.  I set it up a year ago and it's been working fine.

The outside address is 67.x.x.228 and is a target for several VPN clients.
The current static route is 'route outside 0.0.0.0 0.0.0.0 67.x.x.225 1'
The current NAT commands are:
global (outside) 10 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 10 0.0.0.0 0.0.0.0
There is no DMZ
The only access-list is 'access-list inside_nat0_outbound extended permit ip any 10.80.104.0 255.255.255.0 ' (these internal numbers are the VPN pool addresses)

All of this works well. Standard Stuff.  The VPN is a split tunnel and works OK too.

Now they added a cable line, want to move all traffic (except MX) to the new interface, and keep the VPN and outbound MX traffic on the original interface.  The new line has a gateway address of 75.x.x.22 (numbers IP and gateway given me by comcast)

Note: Their email is hosted off-site on an Exchange Server IP 207.x.x.x

So:

I created another outside interface called 'outside_comcast' with a security level of 5 and an IP of 75.x.x.21

I changed the old static route to 'route outside 207.x.x.x 255.255.255.255 67.x.x.225' (static route to MX server thru old interface)

I created a new static route 'route outside_comcast 0.0.0.0 0.0.0.0 75.x.x.22' (default route now on new line)

I tweaked the old NAT command to 'nat (inside) 10 207.x.x.152 255.255.255.255' (10 is a single address (outside interface) pool)

I created a new NAT command to 'nat (inside) 11 0.0.0.0 0.0.0.0' (11 is a single address (outside_comcast interface) pool)

I have a 'global (outside_comcast) 11 interface command

My relevant commands look like this now:

global (outside) 10 interface
global (Outside_Comcast) 11 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 11 0.0.0.0 0.0.0.0
nat (inside 10 207.5.72.153 255.255.255.255
route outside 207.x.x.153 255.255.255.255 67.132.35.255
route Outside_Comcast 0.0.0.0 0.0.0.0 75.x.x.22 1

Result:

Internet, etc works fine.  MX clients can sync up.  All good.
But I lose VPN.  It's like the 'outside' interface no longer exists.  I don't think its VPN config, cuz I can no longer ping the 'outside' interface (from the outside) and I could before the change.  I can ping it from the ASA, and I can 'extended ping' from that 'outside' interface to the MX server.

I've tried a lot of tweaks, but I'm missing something basic in NAT'ing.
0
Comment
Question by:handgunowner
  • 2
  • 2
4 Comments
 
LVL 15

Expert Comment

by:Voltz-dk
ID: 21833400
>nat (inside) 10 207.x.x.152 255.255.255.255
This doesn't serve any purpose.

No, the outside interface no longer exists - becuz you have no routing on it anymore.  It only knows how to "talk" to the MX, nothing else.
0
 

Author Comment

by:handgunowner
ID: 21845767
I only want to do inbound VPN (and outbound MX) on this interface.  So what would be the routing solution?
0
 
LVL 15

Accepted Solution

by:
Voltz-dk earned 500 total points
ID: 21848304
I assume these are remote access VPNs though, that can log from anywhere.  So you'd need routing to all the Internet.  You'd need something like policy-based routing (PBR), but you can't do that on the ASA.

If you are in control of the router with IP 67.x.x.225, you might be able to add some NAT there.  But it'd likely put several limitations on the VPN connectivity you get.
It might only work with TCP encapsulation, and access will likely only be inbound from clients.

Otherwise you need some fancy routing, maybe with VRFs, but that's not something I'm an expert on.
0
 

Author Closing Comment

by:handgunowner
ID: 31468938
I discovered this today by playing with an extra ASA I had here.  The freakin' ASA doesn't have the policy routing support your average PIX has.  I'm going to contact Cisco and see if I can get a workaround.  Thanx
0

Featured Post

PRTG Network Monitor: Intuitive Network Monitoring

Network Monitoring is essential to ensure that computer systems and network devices are running. Use PRTG to monitor LANs, servers, websites, applications and devices, bandwidth, virtual environments, remote systems, IoT, and many more. PRTG is easy to set up & use.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Suggested Solutions

Title # Comments Views Activity
Cisco IP NAT Translation not working 9 26
PEAP authentication 7 27
logging buffered 8 39
Punctured RAID5 Array on Cisco UCS server. 6 0
I recently updated from an old PIX platform to the new ASA platform.  While upgrading, I was tremendously confused about how the VPN and AnyConnect licensing works.  It turns out that the ASA has 3 different VPN licensing schemes. "site-to-site" …
Some of you may have heard that SonicWALL has finally released an app for iOS devices giving us long awaited connectivity for our iPhone's, iPod's, and iPad's. This guide is just a quick rundown on how to get up and running quickly using the app. …
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
Both in life and business – not all partnerships are created equal. As the demand for cloud services increases, so do the number of self-proclaimed cloud partners. Asking the right questions up front in the partnership, will enable both parties …

920 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

13 Experts available now in Live!

Get 1:1 Help Now