Hi, > 1. Use the tunnel endpoint address on Company A's firewall as the > address that gets tunneled. While I haven't gotten a definitive answer > from Cisco, my gut tells me that would not work. When you give this a deeper thought, this probably should work. Unless the company B does the same thing, of course.
> 2. Create a static NAT to an unused address on their outside network and > use that as the tunneled host. I have reason to believe that won't work > either. This works without any trouble. > 3. Land this VPN on Company A's external router (a Cisco 2801), rather > than the ASA. That should allow them to use the NAT'd outside interface > on the firewall as a tunneled address without problems. The router > might need a code/license upgrade to handle the IPSEC, but the more I > think about it, the more this seems like the least kludgey solution. Pain in the... 4., Ask the provider to give you an IP address in addition to the adresses tha you already have. Then use this IP address for NAT (mean, this IP addressess does not necessarilly need to be in your routing table anywhere). Best regards, Jan
signature.asc
Description: OpenPGP digital signature
_______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
