I've got an ipsec tunnel that's up and working with ATT. They require that the phase 2 IP's not be local LAN's, but public IP's.
So, my phase 1 is X.X.X.132, and my Phase 2 is on the same subnet as X.X.X.133. If I ping the remote router's loopback from 133, I get a reply. If I do a one to one nat of .133 to one my my LAN ip's, I can ping their local loopback as well.
The tunnel is intended to hide our local LAN's, and they will only accept traffic from my local .133 address. I've spent all day trying to set up overloading from my local LAN to my phase 2 IP, routing, etc. and I can't make it work.
Anyone have any suggestions? I can post a config if you'd like.
EDIT: IOS, I can put in an ASA if needed though. Config:
!
crypto isakmp policy 26
encr 3des
authentication pre-share
group 2
crypto isakmp key KEY_HERE address 1.0.0.132
!
crypto ipsec transform-set E_SET esp-3des esp-sha-hmac
!
crypto map EBIZ 26 ipsec-isakmp
set peer 1.0.0.132
set transform-set E_SET
set pfs group2
match address NONPROFIT_TO_ATT
!
interface GigabitEthernet0/0
ip address 2.0.0.132 255.255.255.248
no ip redirects
no ip unreachables
no ip proxy-arp
ip verify unicast source reachable-via rx allow-default 100
ip nat enable
ip virtual-reassembly in
duplex auto
speed auto
no mop enabled
crypto map EBIZ
!
interface GigabitEthernet0/1
ip address 10.45.0.4 255.255.255.0
no ip redirects
no ip unreachables
no ip proxy-arp
ip nat enable
ip virtual-reassembly in
duplex auto
speed auto
no mop enabled
!
ip forward-protocol nd
!
ip route 0.0.0.0 0.0.0.0 2.0.0.129
!
ip access-list standard NAT-SOURCE-NETS
permit 10.45.0.0 0.0.0.255
!
ip access-list extended E_SET
permit ip host 2.0.0.133 host 1.0.0.131
ip access-list extended NONPROFIT_TO_ATT
permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
permit ip host 2.0.0.133 X.X..0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.7.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.8.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.0.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.3.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.1.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.4.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.5.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
permit ip host 2.0.0.133 X.X.9.0.0 0.0.255.255
!
logging trap debugging
logging facility local2
access-list 100 permit udp any any eq bootpc
access-list 111 permit ip any any
dialer-list 1 protocol ip permit
!
route-map NAT-SOURCE-NETS permit 20
match ip address NAT-SOURCE-NETS
!
ip nat pool inside_pool 2.0.0.133 2.0.0.133 prefix-length 32
ip nat source route-map NAT-SOURCE-NETS pool inside_pool overload
ip nat outside source route-map NAT-SOURCE-NETS pool inside_pool
!
and a lot of other items, with different routing.