2

I have a Cisco router with Site to Site IPSec. I am wondering if you're able to split tunnel a single host inside, out to the internet, that is also referenced in the interesting traffic ACL?

How does the order of operations work for VPN interesting traffic versus NAT overload?

Example:

Interesting Traffic ACL: 10.1.1.0/24
PAT Host : 10.1.1.20

If the 10.1.1.20 sends traffic, will it hit the crypto ACL and transport across the ipsec tunnel, or will it PAT across the WAN using the NAT overload? It has just a single default static route out to the internet.

If it doesn't, do you have to break apart your interesting ACL to exclude the host, or dney it across the tunnel in the VPN interesting traffic ACL?

Improve this question
2
  • Usually you would remove that host from the crypto map ACL so it isn't interesting traffic. You could also include a destination IP in the ACL so only some packets from that host are 'interesting' and get sent over the crypto tunnel. I don't know the exact NAT/crypto order, so this isn't a real answer.
    – cpt_fink
    Dec 6, 2014 at 5:49
  • PAT is really made up. The RFCs use NAPT for what some people call PAT. See RFC 2663, IP Network Address Translator (NAT) Terminology and Considerations, Section 4.1.2 Network Address Port Translation (NAPT): "NAPT extends the notion of translation one step further by also translating transport identifier (e.g., TCP and UDP port numbers, ICMP query identifiers). This allows the transport identifiers of a number of private hosts to be multiplexed into the transport identifiers of a single external address." There is more in the RFC.
    – Ron Maupin ♦
    Jan 30, 2017 at 16:02

1 Answer 1

Reset to default
4

How does the order of operations work for VPN interesting traffic versus NAT overload?

Quoting from the order of IPSec operations in Cisco IOS, including both IPSec and NAT.

  • Inside to outside traffic:

    • If IPSec then check input access list decryption - for CET (Cisco Encryption Technology) or IPSec
    • check input access list
    • check input rate limits
    • input accounting
    • redirect to web cache
    • policy routing
    • routing
    • NAT inside to outside (local to global translation)
    • crypto (check map and mark for encryption)
    • check output access list
    • inspect (Context-based Access Control (CBAC))
    • TCP intercept
    • encryption
    • Queueing

  • Outside to Inside traffic:

    • If IPSec then check input access list
    • decryption - for CET or IPSec
    • check input access list
    • check input rate limits
    • input accounting
    • redirect to web cache
    • NAT outside to inside (global to local translation)
    • policy routing
    • routing
    • crypto (check map and mark for encryption)
    • check output access list
    • inspect CBAC
    • TCP intercept
    • encryption
    • Queueing

Regarding how to split traffic from a single host between the tunnel and the internet connection: you will need to include the destination at the other end of the tunnel in the ACL for interesting traffic and also make sure you have a route to this destination vía the interface where the crypto map is applied.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.