Re: [fw-wiz] incoming NAT/PATs for VPN users



what kind of vpn will this be? I am assuming it will be a site to site then
you would most likely be doing NAT exemption in which there will be no
nating. Then you would use your crypto access list to permit or deny who is
allowed to access whatever.

On the other hand with VPN's aside and company B was coming from say the
internet on your untrusted interface then you could do either port
redirection or static nat (this would be alot of nat statements). Or if
company B is coming from a different interface (none publically routed
interface that is) then you could do policy based NAT such as NAT0 with an
access-list. this will allow you to make one NAT statement allowing many
users (such company B) from a lower trusted interface to a more trusted
interface (company A). I guess this would be your "magic of networking".

Hope this helps....if you need further explanation then let me know.

KMH

On 2/16/07, James <jimbob.coffey@xxxxxxxxx> wrote:

On 2/10/07, Brian Loe <knobdy@xxxxxxxxx> wrote:
> Lets say company A has a customer, company B. Company A needs to
> provide access to several (lets say many) resources within its network
> to a thousand or so employees at company B. Seems to me that you could
> simply PAT all of company B's connections when they arrive and the
> magic of networking should get them routed to the resources you've
> allowed them and back without any problem. Is there something I'm
> missing here?
>
> Is an incoming PAT not available on, for instance, an ASA? What about
> a PIX at 6.x or 7.x? What about incoming NAT pools for over a thousand
> possible users? Anything change if they're physically coming in on a
> DMZ port as opposed to the outside port - and needing access to
> resources in another, lower DMZ port (don't ask why a VPN customer
> would be trusted more than company A's web servers, that's just how it
> is in this virtual company)?

I think what you are after is outside or bidirectional nat.
available in pix > 6.2 and asa

http://snipurl.com/1aho9

--
jac
_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards

_______________________________________________
firewall-wizards mailing list
firewall-wizards@xxxxxxxxxxxxxxxxxxxxx
https://listserv.icsalabs.com/mailman/listinfo/firewall-wizards


Relevant Pages

  • Re: VPN IP Addressing Problem
    ... block of IPs and they are used up with my public interface on the ... then the NAT for the mail server and PAT for all other traffic. ... but the ASA's external IP address is a private ... Can I just VPN to the public IP that is NATed to the LAN ...
    (comp.dcom.sys.cisco)
  • Cisco 837 - how to set up Inside to Inside NAT for DNS resolution?
    ... I need to setup "inside to inside NAT" as described ... interface Ethernet0 ... dsl operating-mode auto ... ip route 0.0.0.0 0.0.0.0 Dialer1 ...
    (comp.dcom.sys.cisco)
  • Re: Dynamic IP and Static IP on same Dialer Interface
    ... was told that the traffice will 'just arrive at my outside interface', ... ip nat inside ... permit gre any any ...
    (comp.dcom.sys.cisco)
  • Re: moved a working network, now it doesnt work
    ... router I can ping the internet with no problem. ... From one of your Linux machines can you ping the FA 0/1 interface (default ... are NOT natting so if CAN ping from the router, ...
    (comp.dcom.sys.cisco)
  • Re: cisco static nat
    ... Current configuration: ... interface Ethernet0/0 ... no ip directed-broadcast ... ip nat outside ...
    (microsoft.public.windows.server.networking)