Cisco Systems ASA 5580 Manual De Usuario

See the following sample NAT configuration for the above network:

! Enable hairpin for non-split-tunneled VPN client traffic:

! Identify local VPN network, & perform object interface PAT when going to Internet:

! Identify inside network, & perform object interface PAT when going to Internet:

! Use twice NAT to pass traffic between the inside network and the VPN client without

! address translation (identity NAT):

 shows a site-to-site tunnel connecting the Boulder and San Jose offices. For traffic that you 

want to go to the Internet (for example from 10.1.1.6 in Boulder to www.example.com), you need a 
public IP address provided by NAT to access the Internet. The below example uses interface PAT rules. 
However, for traffic that you want to go over the VPN tunnel (for example from 10.1.1.6 in Boulder to 
10.2.2.78 in San Jose), you do not want to perform NAT; you need to exempt that traffic by creating an 
identity NAT rule. Identity NAT simply translates an address to the same address. 

VPN Client

209.165.201.10

Internet

10.1.1.6

Inside

1. SMTP request to 10.1.1.6

4. SMTP request to 10.1.1.6

2. ASA decrypts packet; src address is
now local address

7. ASA encrypts packet; dst address is now real address

5. SMTP response to
VPN Client

8. SMTP response to
VPN Client

6. Identity NAT

3. Identity NAT between inside and VPN Client NWs

303463