We have a Cisco 871 setup with a remote access VPN which works fine. However we now need the RA-VPN to be able to access an IP on the LAN which only speaks with an authorised subnet. IP addresses as follows:
RA-VPN pool = 10.10.10.1 to 10.10.10.6
Split tunnel subnet = 192.168.9.0/24
Host trying to access = 192.168.9.211
"Authorised subnet" = 192.168.9.0/24
So to explain, the RA-VPN can access 192.168.9.1 for example, but not 192.168.9.211. We need to NAT the RA-VPN subnet to be the same 192.168.9.0/24 subnet so host 192.168.9.211 will communicate. If that makes sense?
See some of the config below that we have tried to get working:
interface Vlan10 ip address 192.168.9.254 255.255.255.0 ip nat inside ip virtual-reassembly in ! ip local pool VPN-NAT-ADDRESS 192.168.9.231 192.168.9.236 ip local pool VPN_POOL 10.10.10.1 10.10.10.6 ! ! ip nat inside source route-map VPN-NAT-RMAP pool VPN-NAT-ADDRESS ip nat inside source route-map WAN-OVERLOAD-RMAP interface FastEthernet4 overload ip route 0.0.0.0 0.0.0.0 ... ! ip access-list extended VPN-NAT-ACL permit ip 10.10.10.0 0.0.0.15 host 192.168.9.211 ip access-list extended VPN-ACL permit ip 10.10.10.0 0.0.0.7 192.168.9.0 0.0.0.255 permit ip 192.168.9.0 0.0.0.255 10.10.10.0 0.0.0.7 ! ! route-map VPN-NAT-RMAP permit 10 match ip address VPN-NAT-ACL ! route-map WAN-OVERLOAD-RMAP permit 10 match ip address 101 match interface FastEthernet4 ! access-list 101 deny ip 192.168.9.0 0.0.0.255 10.10.10.0 0.0.0.7 access-list 101 permit ip ... ...
As you can see we have tried to do a route-map which NATs to a pool. Is it because the subnet in question which is tied to vlan10 is set to 'inside', and so wont NAT it as an outside? This can't be changed of course.
Any suggestions or changes would be a great help.