Cisco ASA Series - Implementing NAT-Assigned IP to Public IP Connection

1-6
Cisco ASA Series CLI Configuration Guide
Chapter 1 Setting General VPN Parameters
Implementing NAT-Assigned IP to Public IP Connection
If the user’s client’s revision number matches one of the specified revision numbers, there is no need to
update the client, and no notification message is sent to the user. VPN 3002 clients update without user
intervention and users receive no notification message.
Note If you specify the client-update type as windows (specifying all Windows-based platforms) and later
want to enter a client-update type of win9x or winnt for the same entity, you must first remove the
windows client type with the no form of the command, then use new client-update commands to specify
the new client types.
Implementing NAT-Assigned IP to Public IP Connection
In rare situations, you might want to use a VPN peer’s real IP address on the inside network instead of
an assigned local IP address. Normally with VPN, the peer is given an assigned local IP address to access
the inside network. However, you might want to translate the local IP address back to the peer-s real
public address if, for example, your inside servers and network security is based on the peer’s real IP
address.
Cisco ASA 55xx introduced a way to translate the VPN client’s assigned IP address on the
internal/protected network to its public (source) IP address. This feature supports the scenario where the
target servers/services on the internal network and network security policy require communication with
the VPN client’s public/source IP instead of the assigned IP on the internal corporate network.
You can enable this feature on one interface per tunnel group. Object NAT rules are dynamically added
and deleted when the VPN session is established or disconnected.
Limitations
Because of routing issues, we do not recommend using this feature unless you know you need it.
• Only supports legacy Cisco VPN client (IKEv1) and AnyConnect clients.
• Return traffic to the public IP addresses must be routed back to the ASA so the NAT policy and VPN
policy can be applied.
• Only supports IPv4 assigned and public addresses.
• Multiple peers behind a NAT/PAT device are not supported.
• Does not support load balancing (because of routing issue).
• Does not support roaming.
Detailed Steps
Step 1 In global configuration mode, enter tunnel general.
Step 2 Use this syntax to enable the address translation:
hostname(config-tunnel-general)# nat-assigned-to-public-ip <interface>
This command dynamically installs NAT policies of the assigned IP address to the public IP address of
the source. The interface determines where to apply NAT.
Step 3 Use this syntax to disable the address translation: