• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 525
  • Last Modified:

Private to Private NAT over VPN

I have a vendor requesting to form a VPN where all traffic from me over the VPN NATs to a single private address.  How do I have a NAT statement to map all inside addresses to a single private network address only over the VPN and for the VPN local network will I use the NATed address or still the local network address.  I have a 192.168 network and they are wanting me to NAT to 10.129 address for use of the VPN.   So they are wanting all network activity to appear to come from a single 10.129 address.
0
dublincityschools
Asked:
dublincityschools
  • 2
  • 2
1 Solution
 
lrmooreCommented:
Actually, it's pretty easy.
create a conditional nat acl, ie.
 access-list conditional_nat permit ip 192.168.x.x 255.255.255.0 <their network> 255.255.255.0

apply conditional_nat
 global (outside) 12 10.129.x.x
 nat (inside) 12 access-list conditional_nat

Now, use the natted IP in the crypto match acl
 access-list outside_cryptomap_12 pemit ip host 10.129.x.x <their network> 255.255.255.0

Apply this crypto map acl to the crypto map peer.
Done.
0
 
dublincityschoolsAuthor Commented:
I figured that out this weekend but I am glad to get confirmation from someone with more knowledge.  We send all traffic to them as 10.129.~.29 but they also want all traffic sent back to us as 10.129.~.30.  Will I have to do any configuration on my end for this or just expand the network subnet originally entered in the access-list?

They also want to set it up where every printer they print to is static NAT to a 10.129 address.  I know I will have to put the static nat entry in and also expand the access-list subnet.  Is there anything else?
0
 
lrmooreCommented:
Check out this guide
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_configuration_example09186a00808c9950.shtml
They should nat their end, but if they wont, You might have to do something like
nat (outside) 10 <their subnet>
 global (inside) 10 10.129.x.30

0
 
dublincityschoolsAuthor Commented:
That is the link I found this weekend that helped me.  Thank you for your help.
0

Featured Post

A Cyber Security RX to Protect Your Organization

Join us on December 13th for a webinar to learn how medical providers can defend against malware with a cyber security "Rx" that supports a healthy technology adoption plan for every healthcare organization.

  • 2
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now