Cisco IPSEC Tunnel with hidden local networks

Question

I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's.

So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X.X.X.133. If I ping the remote router's loopback from 133, I get a reply. If I do a one to one nat of .133 to one my my LAN ip's, I can ping their local loopback as well.

The tunnel is intended to hide our local LAN's, and they will only accept traffic from my local .133 address. I've spent all day trying to set up overloading from my local LAN to my phase 2 IP, routing, etc. and I can't make it work.

Anyone have any suggestions? I can post a config if you'd like.

EDIT: IOS, I can put in an ASA if needed though. Config:

!
crypto isakmp policy 26
 encr 3des
 authentication pre-share
 group 2
crypto isakmp key KEY_HERE address 1.0.0.132
!
crypto ipsec transform-set E_SET esp-3des esp-sha-hmac
!
crypto map EBIZ 26 ipsec-isakmp
 set peer 1.0.0.132
 set transform-set E_SET
 set pfs group2
 match address NONPROFIT_TO_ATT
!
interface GigabitEthernet0/0
 ip address 2.0.0.132 255.255.255.248
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip verify unicast source reachable-via rx allow-default 100
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
 crypto map EBIZ
!
interface GigabitEthernet0/1
 ip address 10.45.0.4 255.255.255.0
 no ip redirects
 no ip unreachables
 no ip proxy-arp
 ip nat enable
 ip virtual-reassembly in
 duplex auto
 speed auto
 no mop enabled
!
ip forward-protocol nd
!
ip route 0.0.0.0 0.0.0.0 2.0.0.129
!
ip access-list standard NAT-SOURCE-NETS
 permit 10.45.0.0 0.0.0.255
!
ip access-list extended E_SET
 permit ip host 2.0.0.133 host 1.0.0.131
ip access-list extended NONPROFIT_TO_ATT
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.7.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.8.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.0.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
 permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
!
logging trap debugging
logging facility local2
access-list 100 permit udp any any eq bootpc
access-list 111 permit ip any any
dialer-list 1 protocol ip permit
!
route-map NAT-SOURCE-NETS permit 20
 match ip address NAT-SOURCE-NETS
!
ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 32
ip nat source route-map NAT-SOURCE-NETS pool inside_pool overload
ip nat outside source route-map NAT-SOURCE-NETS pool inside_pool
!

and a lot of other items, with different routing.

Answer 1

I see that you are using NAT Virtual Interface (NVI). With NVI, you no longer use "inside/outside".

Please try the followings:

• Remove ip nat outside source route-map NAT-SOURCE-NETS pool inside_pool.
• Change prefix-length 32 to prefix-length 29 in ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 32. Therefore, the better/workring NAT statement should be ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 29.

Hope it is helpful and you can solve the issue.

Answer 2

If your NAT to a LAN IP works statically then your NAT confit is the issue, could you post your output to the show ip NAT statistics before and after you try some test traffic?

EDIT

Your NAT config is very odd, remove the outside NAT command and list your ip NAT inside and ip NAT outside interfaces under your private and public interfaces respectively and you should see some results