bwright1
asked on
Cisco ASA 5505 Site-to-Site VPN with NAT using ASDM
I've done many VPN setups using the ASDM Site-to-Site Wizard in the past. But, a company we are trying to connect with now is requiring us to NAT our internal server IP to a public address they have provided. I have searched to no avail on this and tried many configurations. A walkthrough of the correct setup using the ASDM GUI would be appreciated. I know nothing about using CLI and I would be scared I would mess something up and cause more problems. It would be helpful for what to put into the VPN Wizard and then how to setup the NAT'ing. Static NAT or Policy NAT? Do I de-select NAT Exemption on the VPN Wizard screen? These are the issues I'm having with this. If I haven't explained very well, please let me know of any additional info you may need to help me. Thank You in advance.
My parameters: (fake addresses)
Peer IP: 173.243.xxx.xxx
Internal Server IP: 172.16.2.153 (needs to be NATed to 161.250.141.249 for traffic on TCP port 2004)
Company I'm connecting to:
Peer IP: 161.250.81.xxx
Encryption Domain: 162.250.140.1
My parameters: (fake addresses)
Peer IP: 173.243.xxx.xxx
Internal Server IP: 172.16.2.153 (needs to be NATed to 161.250.141.249 for traffic on TCP port 2004)
Company I'm connecting to:
Peer IP: 161.250.81.xxx
Encryption Domain: 162.250.140.1
Last Comment
ASKER
Thank you for your help. I used the VPN wizard and I have phase one of the tunnel up but phase two will only receive packets and not transmit. Right now that's because I have not setup NAT. I would like your recommendation on that. Static NAT or Static Policy NAT? Below are the steps I took to create the tunnel and what entries showed up in ASDM after it was created. Can you tell me if this is all correct?
This was the only decision I wasn't sure about during the wizard. I left it checked.
This showed up in NAT Rules after the wizard.
These show up in the ACL Manager
This shows up in Site-to-Site VPN Crypto Maps
This is the VPN Session details: You will notice I am receiving packets from the other side but not transmitting a reply to those ping packets. The next step is to setup NAT. This is where I need help on what to put in the fields when I choose ADD STATIC NAT RULE. example(source?, destination?, PAT?, etc.......) Thank you so much for your help.
This was the only decision I wasn't sure about during the wizard. I left it checked.
This showed up in NAT Rules after the wizard.
These show up in the ACL Manager
This shows up in Site-to-Site VPN Crypto Maps
This is the VPN Session details: You will notice I am receiving packets from the other side but not transmitting a reply to those ping packets. The next step is to setup NAT. This is where I need help on what to put in the fields when I choose ADD STATIC NAT RULE. example(source?, destination?, PAT?, etc.......) Thank you so much for your help.
ASKER CERTIFIED SOLUTION
THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.
View this solution by signing up for a free trial.
Members can start a 7-Day free trial and enjoy unlimited access to the platform.
ASKER
Thank You for your help. The tunnel is up and working now.
Cisco
Cisco PIX is a dedicated hardware firewall appliance; the Cisco Adaptive Security Appliance (ASA) is a firewall and anti-malware security appliance that provides unified threat management and protection the PIX does not. Other Cisco devices and systems include routers, switches, storage networking, wireless and the software and hardware for PIX Firewall Manager (PFM), PIX Device Manager (PDM) and Adaptive Security Device Manager (ASDM).
27K
Questions
--
Followers
--
Top Experts
Get a personalized solution from industry experts
TRUSTED BY
Cisco order of operations is for NAT to occur before crypto, so the traffic will be NAT'd, then encrypted. For the encryption to work, the interesting traffic has to match the public IP of the server.