I connect the 'net with a public static IP (my router's IP address for NAT) and a /29 subnet (for machines behind the router).
On my router, I have:
#sh ip route | inc x.x x.x.0.0/16 is variably subnetted, 3 subnets, 2 masks C x.x.196.62/32 is directly connected, Dialer1 C x.x.206.72/29 is directly connected, BVI2 #sh run int dial 1 | inc zone zone-member security out-zone #sh run int bvi 2 | inc zone zone-member security in-zone
The zone-pair is fairly restrictive. I would like to relax the restrictions for clients which first connect via a remote-access VPN:
#sh run int virtual-template 1 zone-member security relaxed-zone
Now clients connecting via VPN must be assigned a private IP address. (I don't allocate public addresses to clients, right?):
# sh ip local pool Pool Begin End Free In use Blocked RANET100 192.168.100.230 192.168.100.250 20 1 0
So now if I want to get a packet to x.y.206.73 from 192.168.100.230, that's fine - the router has the information it needs. But it means that the host x.y.206.73 would have to permit traffic to its public-scoped IP address from a private address ... something it would normally be configured to ignore!
So this is a dirty hack, right? What is the True Path (TM)? Should I just multi-home the hosts with the public IP addresses so that they also have a private IP address?