Hello Justin: > -----Original Message----- > From: [EMAIL PROTECTED] [mailto:cisco-nsp- > [EMAIL PROTECTED] On Behalf Of Justin M. Streiner > Sent: Wednesday, July 11, 2007 6:49 PM > To: [email protected] > Subject: [c-nsp] ASA - packets tripping on NAT rule? > > I'm configuring a new ASA 5505 at a remote site and have a site-to-site > VPN working between the main office and the remote site. Users were > experiencing problems reaching a server at the remote office over the > VPN > tunnel, and when I did a packet trace, I saw traffic failing at the > last > step, which was a NAT rule check. This struck me as very odd since > traffic that traverses the VPN tunnel is exempted from having NAT. > > Has anyone run into anything like this before? > > I have a sneaky suspicion this is going to be something dumb :( > I think you have to actually tell the ASA not to NAT the traffic from your VPN connections to your servers. Using this example:
Server Net: 192.168.1.0/24 VPN Net: 192.168.2.0/24 access-list nonat permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0 nat (inside) 0 access-list nonat Without that, all traffic, including that of your VPN's, will hit the "nat (inside) 1" rule. Regards, Mike [EMAIL PROTECTED] (work) [EMAIL PROTECTED] (!work) _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
