Site-to-site IPSec VPN through NAT
Thanks to: http://www.howfantastic.net/ Network Diagram Premise A branch office with an ADSL connection would like to access corporate and local resources without running a local client on office machines. Split tunnelling is not required, all traffic must be routed back up to the corporate HQ. Only one static IP has been provided by the ADSL ISP. Config We’ll need to port forward UDP 500 (IKE) so that our corporate ASA can connect to the branch ASA. On the ADSL router we use the following NAT rules: ip nat inside source list LAN interface FastEthernet0/0 overload ip nat inside source static udp 192.168.1.1 500 interface FastEthernet0/0 500 You’ll see I’ve moved the B-End IP of the IPSec tunnel to the ADSL router so the A-End config doesn’t change. All I need to do is renumber the blue linknet to my chosen RFC1918 subnet of 192.168.1.0/24 and give my ASA a new default route matching the ADSL routers interface and all is well. Testing One thing which has bitten ...