Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

First time configureing remote access VPN for 8.3 / 8.4 so the NAT and VPN commands are a bit diffrent for me.

Below is the VPN config and the coresponding NAT to NO NAT the IP space. If someone could have a look over it and let me know if I am missing anything. The network is / 24 ha, not a typo.

crypto ikev1 enable outside

crypto ikev1 policy 10
encryption 3des
authentication pre-share
hash sha

access-list SPLIT-TUNNEL-VPN standard permit
access-list SPLIT-TUNNEL-VPN standard permit

group-policy REMOTE-VPN-GP internal
group-policy REMOTE-VPN-GP attributes
vpn-tunnel-protocol ikev1
address-pools value REMOTE-VPN-POOL
split-tunnel-policy tunnelspecified
split-tunnel-network-list value SPLIT-TUNNEL-VPN
dns-server value

tunnel-group REMOTE-VPN-TG type remote-access
tunnel-group REMOTE-VPN-TG general-attributes
default-group-policy REMOTE-VPN-GP
authentication-server-group LOCAL

tunnel-group REMOTE-VPN-TG ipsec-attributes
ikev1 pre-shared-key **********

ip local pool REMOTE-VPN-POOL mask

crypto ipsec ikev1 transform-set ESP-3DES-SHA esp-3des esp-sha-hmac
crypto dynamic-map OUTSIDE-DYNMAP 65535 set ikev1 transform-set ESP-3DES-SHA

crypto map OUTSIDE_MAP 65535 ipsec-isakmp dynamic OUTSIDE-DYNMAP
crypto map OUTSIDE_MAP interface outside

//No NAT subnet

object network INSIDE_LAN

object network VPN_LAN

nat (inside,outside) source static INSIDE_LAN INSIDE_LAN  destination static VPN_LAN VPN_LAN

or would I do this for the no nat:

nat (inside,outside) 1 source static any any destination static VPN_LAN VPN_LAN

My NAT is currently set up as:

object network LAN_NAT
nat (inside,outside) dynamic interface
share|improve this question
up vote 1 down vote accepted

If is your inside interface/LAN then what is

You have given the object name of VPN_LAN to the subnet? However, you define the remote-access VPN address pool as The addresses assigned to the client VPN adapters will be in the range of

I am going to assume that is not needed and that your inside is and your VPN client adapters will have IP's pulled from the pool -- you may just want to make this -- however I will continue with your existing pool.

You can configure your inside outbound dynamic interface PAT setup with the following. You have created another LAN_NAT object when you can define your dynamic interface PAT right in the INSIDE_LAN object -- they appear in two different parts of the configuration (subnet definition and object NAT) but are (and can) still defined in the same object.

object network INSIDE_LAN
 nat (inside,outside) dynamic interface

Below is a network object created that represents the IP block that is the pool. Does not redefine the pool itself as that is ip local pool.

object network RAVPN_POOL
 subnet   ! adjust this and pool itself to meet needs

Configure your identity NAT (no nat) as follows -- not in an object, but a twice NAT.

nat (inside,outside) source INSIDE_LAN INSIDE_LAN destination static RAVPN_POOL RAVPN_POOL description [[ Inside to RA Identity NAT ]]

Assuming I understand your setup you can then rid yourself of the LAN_NAT and VPN_LAN objects and the entry in the SPLIT-TUNNEL-VPN ACL.

no access-list SPLIT-TUNNEL-VPN standard permit
no object network LAN_NAT
no object network VPN_LAN

There are some additional things to be considered on your P1/IKE policy as well -- 3DES/MD5 in P1 when you have P2 defined as 3DES/SHA is fine, but slightly odd.

share|improve this answer
Thanks for the great write up. I actually had the wrong IP range in my VPN pool. It was supposed to be I also change the P1 to SHA as well. It looks like with the VPN range correction I should be good, correct? – evolvd Nov 3 '11 at 9:28
@evolvd Just ensure that whatever range you choose you have the pool set correctly, the NAT Identity set correctly, and split-tunnel-network-list ACL set correctly. Your P1, P2/crypto map, and Tunnel-Group look fine. – Weaver Nov 5 '11 at 15:19

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.