1

We have a Cisco ASA 5505 box. We are trying to connect to a stock exchange server through a VPN. I set up a site to site VPN from our network to the exchange. All traffic for the 206.200.0.0/16 net goes through the VPN. This appears to be working correctly.

The next step is that I have to set up something so that traffic from our internal fixed IP address of 192.168.45.100 appears to the server on the other end to come from a 10.9.100.113 address. We only want this rule to apply when traffic is coming inside from 192.168.45.100 bound for 206.200.0.0.

Is this set up as a static NAT? Very new to this Cisco world.

1
  • To clarify, do you need the NAT rule to only translate when the source address is 192.168.45.100? Or do you want to only allow 192.168.45.100 to access the server? The former cannot be done with static NATing, and the latter can be done easily with an ACL.
    – Goodies
    Jul 20 '15 at 15:47
1

What you're asking for is called Policy NAT. You use an access list to define what traffic gets NATed. I don't have your configuration, so here is a sample of what you need to do.

ip access-list extended SE-VPN permit ip host 192.168.45.100 206.200.0.0 255.255.0.0
global (outside) 100 10.9.100.113
nat (inside) 100 access-list SE-VPN

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.