1
RemoteSite   (172.16.1.*)
    |  
 Internet --- InternetUsers
    |
   ASA --- LocalUsers (192.168.1.*)
    |
 InsideNet     (10.1.1.*)
    |
  Router
    |   
 DeeperNet     (10.22.22.*)

I have a Cisco ASA 5510 with three interfaces, inside/outside/localusers.

On the inside there are two subnets, InsideNet and DeeperNet, connected by a simple router. The ASA's routing table has an entry for DeeperNet.

The remote sites connects via a lan-to-lan VPN on the outside interface. (This VPN includes InsideNet and DeeperNet, so a user from RemoteSite can contact servers on DeeperNet)

All Traffic to a web server on InsideNet (10.1.1.1) needs to be redirected to a web server on Deepernet (10.22.22.22) For localusers this is easily done with a static NAT rule:

static (inside,localusers) 10.1.1.1 10.22.22.22 netmask 255.255.255.255

Any traffic from internet users comes to the public IP of the ASA, and is also easy to handled with a static NAT rule.

static (inside,outside) 203.203.203.203 10.22.22.22 netmask 255.255.255.255

Where I'm having problems is with the VPN users. I'm not sure exactly how the VPN functionality interacts with NAT, and what order NAT & VPN get applied to an ASA.

How do I configure a static NAT rule so any RemoteUsers sending data to 10.1.1.1 over the VPN have it redirected to 10.22.22.22?

Does this NAT take effect before or after VPN traffic selection? (that is, if the VPN was configured as RemoteSite<-> InsideNet only would traffic to 10.1.1.1 come through and be NATTed to the DeeperNet IP, or would the ASA look at the real IPs and decide it's not part of the VPN?)

Dennis Williamson
  • 62,149
  • 16
  • 116
  • 151
DrStalker
  • 6,946
  • 24
  • 79
  • 107

1 Answers1

1

From experience, I belive NAT gets applied before VPNs. I've only dealt with infrastructure VPNs though, which may be different to VPN users.

Cian
  • 5,838
  • 1
  • 28
  • 40
  • this is a lan-to-lan VPN, which I assume is what you mean by "infrastructure VPN" - were you using cisco gear when you made thos eobservations? I know Cisco does NAT & firewall in the opposite order to iptables, so any other vendors won't be a good comparison here. – DrStalker Aug 31 '09 at 06:56
  • Yep. Using a PIX 506 (I think). – Cian Aug 31 '09 at 07:06