Chris-- It appears that the PIX is has a global NAT statement to translate all dynamic traffic to the x.x.x.5 IP which is the IP on the outside interface.
I suggest that you leave the x.x.x.5 IP for management of the PIX and translate all non-VPN outbound traffic to something else, say x.x.x.6. Edit your route map ACL appropriately so you do not let any traffic from x.x.x.5 go out the ISP-2 path. cjw On Sun, Jun 19, 2011 at 11:00 AM, <[email protected]> wrote: > > Message: 2 > Date: Sun, 19 Jun 2011 13:05:11 +0200 > From: "Chris Knipe" <[email protected]> > To: <[email protected]> > Subject: [c-nsp] route-map & nat predicament > Message-ID: <[email protected]> > Content-Type: text/plain; charset="us-ascii" > > Hi All, > > > > A bit of a tough one that I cannot seem to find a solution for. Diagram: > > > > ----- ISP1 > > PIX --- Cisco 8345 > > ----- ISP2 > > > > Our PIX is configured with x.x.x.5, whilst the LAN side of the 3847 has > x.x.x.1. We have static IPs from ISP1 and ISP2, with a BGP session to ISP2 > but not from ISP1 (by choice, due to bandwidth constraints). Our default > route goes out via ISP2. > > > > What's happening now, is that legacy clients are configured to connect to > our Cisco PIX (IPSec VPNs) to an IP address assigned from ISP1. I take > care > of this by natting the traffic, and it is working successfully. > > > > ip nat inside source static x.x.x.5 a.a.a.126 > > > > route-map PolicyRoutes, permit, sequence 10 > > Match clauses: > > ip address (access-lists): toISP1 > > Set clauses: > > ip next-hop b.b.b.b.233 > > Policy routing matches: 8344989 packets, 528857596 bytes > > > > Extended IP access list toISP1 > > 10 permit ip a.a.c.68 0.0.0.3 any (24011 matches) > > 20 permit ip a.a.b.96 0.0.0.7 any (571600 matches) > > 30 permit ip a.a.a.64 0.0.0.63 any (5980125 matches) > > 35 permit udp host x.x.x.5 any (2119303 matches) > > 40 deny ip any any (19629171 matches) > > > > The problem now, is that when a user connects directly to the PIX via > x.x.x.5 instead of a.a.a.126 the return traffic is matched by the > route-map, > and sent via ISP1, instead of ISP2. Removing the route-map or amending the > access-lists, customers connecting to a.a.a.126 via ISP1, has their return > traffic sent via ISP2. > > > > Is there any way that I can send connections from any to a.a.a.126 via > ISP1, > and connections from any to x.x.x.5 via ISP2, whilst still keeping the NAT > in place to nat all traffic to a.a.a.126 ? > > > > Hope this makes sense. > > > > -- > Chris. > > > > > > > > ------------------------------ > > _______________________________________________ > cisco-nsp mailing list > [email protected] > https://puck.nether.net/mailman/listinfo/cisco-nsp > > End of cisco-nsp Digest, Vol 103, Issue 55 > ****************************************** > _______________________________________________ cisco-nsp mailing list [email protected] https://puck.nether.net/mailman/listinfo/cisco-nsp archive at http://puck.nether.net/pipermail/cisco-nsp/
