1

I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's.

So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X.X.X.133. If I ping the remote router's loopback from 133, I get a reply. If I do a one to one nat of .133 to one my my LAN ip's, I can ping their local loopback as well.

The tunnel is intended to hide our local LAN's, and they will only accept traffic from my local .133 address. I've spent all day trying to set up overloading from my local LAN to my phase 2 IP, routing, etc. and I can't make it work.

Anyone have any suggestions? I can post a config if you'd like.

EDIT: IOS, I can put in an ASA if needed though. Config: 

!
crypto isakmp policy 26
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key KEY_HERE address 1.0.0.132
!
crypto ipsec transform-set E_SET esp-3des esp-sha-hmac
!
crypto map EBIZ 26 ipsec-isakmp
 set peer 1.0.0.132
 set transform-set E_SET
 set pfs group2
 match address NONPROFIT_TO_ATT
!
interface GigabitEthernet0/0
 ip address 2.0.0.132 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip verify unicast source reachable-via rx allow-default 100
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
 crypto map EBIZ
!
interface GigabitEthernet0/1
 ip address 10.45.0.4 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
!
ip forward-protocol nd
!
ip route 0.0.0.0 0.0.0.0 2.0.0.129
!
ip access-list standard NAT-SOURCE-NETS
 permit 10.45.0.0 0.0.0.255
!
ip access-list extended E_SET
 permit ip host 2.0.0.133 host 1.0.0.131
ip access-list extended NONPROFIT_TO_ATT
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.7.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.8.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
!
logging trap debugging
logging facility local2
access-list 100 permit udp any any eq bootpc
access-list 111 permit ip any any
dialer-list 1 protocol ip permit
!
route-map NAT-SOURCE-NETS permit 20
 match ip address NAT-SOURCE-NETS
!
ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 32
ip nat source route-map NAT-SOURCE-NETS pool inside_pool overload
ip nat outside source route-map NAT-SOURCE-NETS pool inside_pool
!

and a lot of other items, with different routing.

Improve this question
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin♦ Feb 21 '18 at 16:34
1

I see that you are using NAT Virtual Interface (NVI). With NVI, you no longer use "inside/outside".

Please try the followings:

  • Remove ip nat outside source route-map NAT-SOURCE-NETS pool inside_pool.
  • Change prefix-length 32 to prefix-length 29 in ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 32. Therefore, the better/workring NAT statement should be ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 29.

Hope it is helpful and you can solve the issue.

Improve this answer
0

If your NAT to a LAN IP works statically then your NAT confit is the issue, could you post your output to the show ip NAT statistics before and after you try some test traffic?

EDIT

Your NAT config is very odd, remove the outside NAT command and list your ip NAT inside and ip NAT outside interfaces under your private and public interfaces respectively and you should see some results

Improve this answer
  • This is NAT Virtual Interface (NVI). With NVI, you just need "ip nat enable" rather than "ip nat inside" and "ip nat outside": – Hung Tran Feb 17 '18 at 14:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.