bwright1
asked on
Cisco ASA 5505 Site-to-Site VPN with NAT using ASDM
I've done many VPN setups using the ASDM Site-to-Site Wizard in the past. But, a company we are trying to connect with now is requiring us to NAT our internal server IP to a public address they have provided. I have searched to no avail on this and tried many configurations. A walkthrough of the correct setup using the ASDM GUI would be appreciated. I know nothing about using CLI and I would be scared I would mess something up and cause more problems. It would be helpful for what to put into the VPN Wizard and then how to setup the NAT'ing. Static NAT or Policy NAT? Do I de-select NAT Exemption on the VPN Wizard screen? These are the issues I'm having with this. If I haven't explained very well, please let me know of any additional info you may need to help me. Thank You in advance.
My parameters: (fake addresses)
Peer IP: 173.243.xxx.xxx
Internal Server IP: 172.16.2.153 (needs to be NATed to 161.250.141.249 for traffic on TCP port 2004)
Company I'm connecting to:
Peer IP: 161.250.81.xxx
Encryption Domain: 162.250.140.1
My parameters: (fake addresses)
Peer IP: 173.243.xxx.xxx
Internal Server IP: 172.16.2.153 (needs to be NATed to 161.250.141.249 for traffic on TCP port 2004)
Company I'm connecting to:
Peer IP: 161.250.81.xxx
Encryption Domain: 162.250.140.1
ASKER
Thank you for your help. I used the VPN wizard and I have phase one of the tunnel up but phase two will only receive packets and not transmit. Right now that's because I have not setup NAT. I would like your recommendation on that. Static NAT or Static Policy NAT? Below are the steps I took to create the tunnel and what entries showed up in ASDM after it was created. Can you tell me if this is all correct?
This was the only decision I wasn't sure about during the wizard. I left it checked.
This showed up in NAT Rules after the wizard.
These show up in the ACL Manager
This shows up in Site-to-Site VPN Crypto Maps
This is the VPN Session details: You will notice I am receiving packets from the other side but not transmitting a reply to those ping packets. The next step is to setup NAT. This is where I need help on what to put in the fields when I choose ADD STATIC NAT RULE. example(source?, destination?, PAT?, etc.......) Thank you so much for your help.
This was the only decision I wasn't sure about during the wizard. I left it checked.
This showed up in NAT Rules after the wizard.
These show up in the ACL Manager
This shows up in Site-to-Site VPN Crypto Maps
This is the VPN Session details: You will notice I am receiving packets from the other side but not transmitting a reply to those ping packets. The next step is to setup NAT. This is where I need help on what to put in the fields when I choose ADD STATIC NAT RULE. example(source?, destination?, PAT?, etc.......) Thank you so much for your help.
ASKER CERTIFIED SOLUTION
membership
Create a free account to see this answer
Signing up is free and takes 30 seconds. No credit card required.
ASKER
Thank You for your help. The tunnel is up and working now.
Cisco order of operations is for NAT to occur before crypto, so the traffic will be NAT'd, then encrypted. For the encryption to work, the interesting traffic has to match the public IP of the server.