Solved

NAT'ing on two WAN interfaces with VPN

Posted on 2008-06-19
4
196 Views
Last Modified: 2010-04-21
I'm having a NAT problem with an ASA5510 (v7.1(2).

Currently there is one T1 which hits a router and is then connected to the ASA.  I set it up a year ago and it's been working fine.

The outside address is 67.x.x.228 and is a target for several VPN clients.
The current static route is 'route outside 0.0.0.0 0.0.0.0 67.x.x.225 1'
The current NAT commands are:
global (outside) 10 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 10 0.0.0.0 0.0.0.0
There is no DMZ
The only access-list is 'access-list inside_nat0_outbound extended permit ip any 10.80.104.0 255.255.255.0 ' (these internal numbers are the VPN pool addresses)

All of this works well. Standard Stuff.  The VPN is a split tunnel and works OK too.

Now they added a cable line, want to move all traffic (except MX) to the new interface, and keep the VPN and outbound MX traffic on the original interface.  The new line has a gateway address of 75.x.x.22 (numbers IP and gateway given me by comcast)

Note: Their email is hosted off-site on an Exchange Server IP 207.x.x.x

So:

I created another outside interface called 'outside_comcast' with a security level of 5 and an IP of 75.x.x.21

I changed the old static route to 'route outside 207.x.x.x 255.255.255.255 67.x.x.225' (static route to MX server thru old interface)

I created a new static route 'route outside_comcast 0.0.0.0 0.0.0.0 75.x.x.22' (default route now on new line)

I tweaked the old NAT command to 'nat (inside) 10 207.x.x.152 255.255.255.255' (10 is a single address (outside interface) pool)

I created a new NAT command to 'nat (inside) 11 0.0.0.0 0.0.0.0' (11 is a single address (outside_comcast interface) pool)

I have a 'global (outside_comcast) 11 interface command

My relevant commands look like this now:

global (outside) 10 interface
global (Outside_Comcast) 11 interface
nat (inside) 0 access-list inside_nat0_outbound
nat (inside) 11 0.0.0.0 0.0.0.0
nat (inside 10 207.5.72.153 255.255.255.255
route outside 207.x.x.153 255.255.255.255 67.132.35.255
route Outside_Comcast 0.0.0.0 0.0.0.0 75.x.x.22 1

Result:

Internet, etc works fine.  MX clients can sync up.  All good.
But I lose VPN.  It's like the 'outside' interface no longer exists.  I don't think its VPN config, cuz I can no longer ping the 'outside' interface (from the outside) and I could before the change.  I can ping it from the ASA, and I can 'extended ping' from that 'outside' interface to the MX server.

I've tried a lot of tweaks, but I'm missing something basic in NAT'ing.
0
Comment
Question by:handgunowner
  • 2
  • 2
4 Comments
 
LVL 15

Expert Comment

by:Voltz-dk
ID: 21833400
>nat (inside) 10 207.x.x.152 255.255.255.255
This doesn't serve any purpose.

No, the outside interface no longer exists - becuz you have no routing on it anymore.  It only knows how to "talk" to the MX, nothing else.
0
 

Author Comment

by:handgunowner
ID: 21845767
I only want to do inbound VPN (and outbound MX) on this interface.  So what would be the routing solution?
0
 
LVL 15

Accepted Solution

by:
Voltz-dk earned 500 total points
ID: 21848304
I assume these are remote access VPNs though, that can log from anywhere.  So you'd need routing to all the Internet.  You'd need something like policy-based routing (PBR), but you can't do that on the ASA.

If you are in control of the router with IP 67.x.x.225, you might be able to add some NAT there.  But it'd likely put several limitations on the VPN connectivity you get.
It might only work with TCP encapsulation, and access will likely only be inbound from clients.

Otherwise you need some fancy routing, maybe with VRFs, but that's not something I'm an expert on.
0
 

Author Closing Comment

by:handgunowner
ID: 31468938
I discovered this today by playing with an extra ASA I had here.  The freakin' ASA doesn't have the policy routing support your average PIX has.  I'm going to contact Cisco and see if I can get a workaround.  Thanx
0

Featured Post

Threat Intelligence Starter Resources

Integrating threat intelligence can be challenging, and not all companies are ready. These resources can help you build awareness and prepare for defense.

Join & Write a Comment

Overview The Cisco PIX 501, PIX 506e, ASA 5505 and ASA 5510 (most if not all of this information will be relevant to the PIX 515e but I do not have a working configuration handy to verify the validity) are primarily used within small to medium busi…
I've written this article to illustrate how we can implement a Dynamic Multipoint VPN (DMVPN) with both hub and spokes having a dynamically assigned non-broadcast multiple-access (NBMA) network IP (public IP). Here is the basic setup of DMVPN Pha…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…
After creating this article (http://www.experts-exchange.com/articles/23699/Setup-Mikrotik-routers-with-OSPF.html), I decided to make a video (no audio) to show you how to configure the routers and run some trace routes and pings between the 7 sites…

705 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question

Need Help in Real-Time?

Connect with top rated Experts

19 Experts available now in Live!

Get 1:1 Help Now