«

Hi there,

I have a little problem.
I need to NAT a certain tunnel form local nat 192.168.2.0/24 to
172.16.17.34.
I was hoping to use policy based nat with nat a nat+access-list and a
global (outside) 172.16.17.34. However an access-list with nat can only
work on nat 0. Which we use to exempt the other VPN tunnels from the
global nat.

If anyone has experience with natting a single VPN with a PIX please
give me some leads, because I'm pretty much stuck. Also due to the fact
that you can't create virtual Loopback interfaces ob the PIX which I
usually use on a Cisco router IOS, to achieve this.

Greetz,


Raymond

Raymond Doetjes wrote:
> Hi there,
>
> I have a little problem.
> I need to NAT a certain tunnel form local nat 192.168.2.0/24 to
> 172.16.17.34.
> I was hoping to use policy based nat with nat a nat+access-list and a
> global (outside) 172.16.17.34. However an access-list with nat can only
> work on nat 0. Which we use to exempt the other VPN tunnels from the
> global nat.
>
> If anyone has experience with natting a single VPN with a PIX please
> give me some leads, because I'm pretty much stuck. Also due to the fact
> that you can't create virtual Loopback interfaces ob the PIX which I
> usually use on a Cisco router IOS, to achieve this.
>
> Greetz,
>
>
> Raymond

The feature you are looking for is called policy nat. It does permit
the use of an acl on a nat statement. I think it was introduced in
something like ver 6.2.

--
-------------------------
Paul Stewart
Lexnet Inc.
Email address is in ROT13

In article <41c6ada6$>, PES <> wrote:
:The feature you are looking for is called policy nat. It does permit
:the use of an acl on a nat statement. I think it was introduced in
:something like ver 6.2.

It was 6.3(2) that introduced it.

http://www.cisco.com/univercd/cc/td/....htm#wp1113601

[Yey! Another bit of trivia successfully committed to memory ]
--
We don't need no side effect-ing
We don't need no scope control
No global variables for execution
Hey! Did you leave those args alone? -- decvax!utzoo!utcsrgv!roderick