0

We have a Cisco 871 setup with a remote access VPN which works fine. However we now need the RA-VPN to be able to access an IP on the LAN which only speaks with an authorised subnet. IP addresses as follows:

RA-VPN pool = 10.10.10.1 to 10.10.10.6
Split tunnel subnet = 192.168.9.0/24
Host trying to access = 192.168.9.211
"Authorised subnet" = 192.168.9.0/24

So to explain, the RA-VPN can access 192.168.9.1 for example, but not 192.168.9.211. We need to NAT the RA-VPN subnet to be the same 192.168.9.0/24 subnet so host 192.168.9.211 will communicate. If that makes sense?

See some of the config below that we have tried to get working:

interface Vlan10
 ip address 192.168.9.254 255.255.255.0
 ip nat inside
 ip virtual-reassembly in
!
ip local pool VPN-NAT-ADDRESS 192.168.9.231 192.168.9.236
ip local pool VPN_POOL 10.10.10.1 10.10.10.6
!
!
ip nat inside source route-map VPN-NAT-RMAP pool VPN-NAT-ADDRESS
ip nat inside source route-map WAN-OVERLOAD-RMAP interface FastEthernet4 overload
ip route 0.0.0.0 0.0.0.0 ...
!
ip access-list extended VPN-NAT-ACL
 permit ip 10.10.10.0 0.0.0.15 host 192.168.9.211
ip access-list extended VPN-ACL
 permit ip 10.10.10.0 0.0.0.7 192.168.9.0 0.0.0.255
 permit ip 192.168.9.0 0.0.0.255 10.10.10.0 0.0.0.7
!
!
route-map VPN-NAT-RMAP permit 10
 match ip address VPN-NAT-ACL
!
route-map WAN-OVERLOAD-RMAP permit 10
 match ip address 101
 match interface FastEthernet4
!
access-list 101 deny   ip 192.168.9.0 0.0.0.255 10.10.10.0 0.0.0.7
access-list 101 permit ip ... ...

As you can see we have tried to do a route-map which NATs to a pool. Is it because the subnet in question which is tied to vlan10 is set to 'inside', and so wont NAT it as an outside? This can't be changed of course.

Any suggestions or changes would be a great help.

  • Please share the part where VPN_POOL is terminated. Is it configured as inside interface? In addition routing table also is needed. cheers. – Viktor Borisov Aug 29 '19 at 11:34
  • @ViktorBorisov Not sure what you mean by VPN_POOL is terminated. Its referenced in the isakmp client configuration. And the routing table only has one default route which I removed the gateway address for security. No other routes are present. Hope that helps. – dmx Aug 29 '19 at 11:55
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can provide and accept your own answer. – Ron Maupin Dec 15 '19 at 7:56
1

If I understand you correctly you have FastEthernet 4 configured as an outside interface with some crypto map. The Goal is to do a source NAT for traffic cumming from the RA VPN.

However you are doing destination NAT. Here you are what is the logic of the operation when ip nat commands are used:

**ip nat inside source:**

Translates the source IP address of packets that travel from inside to outside.
Translates the destination IP address of packets that travel from outside to inside.

**ip nat outside source:**

Translates the source IP address of packets that travel from outside to inside.
Translates the destination IP address of packets that travel from inside to outside.

Have you considered thying to use ip nat outside statement instead?

| improve this answer | |
  • ip nat outside on which sorry? The VLAN10 interface or the route-map to the pool command? VLAN10 I cannot change as this is an existing network, and must stay the same (as mentioned in the OP) And I have tried changing the 'inside' to 'outside' for the route-map nat to the pool command to no effect. – dmx Aug 29 '19 at 16:22

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.