I have an IPsec VPN setup like this:

[Remote users]-[Remote ASA] <-VPN-> [My ASA]-[Subnet A]-[Router 2]-[Subnet B]

The VPN is set to handle traffic between [remote users] and [Subnet A]; it does not include [Subnet B]. Pretend the firewall rules for all routers are to permit everything.

Now I want to redirect traffic that comes over the VPN to a specific IP on [subnet A] ( to an IP on [Subnet B] (

If I add a rule on [My ASA] to NAT traffic to original IP to new IP,

1) Will this affect the connections coming in over the VPN? (ie: the VPN packets are unencrypted and then NAT is applied) 2) Will this work when the post-NAT target is on Subnet-B, which is not part of the VPN traffic selection?


These two statements are not trivial to throw together."The VPN is set to handle traffic between [remote users] and [Subnet A] it does not include [Subnet B]." and "Pretend the firewall rules for all routers are to permit everything."

But, I'm going to assume that you mean that the remote ASA is configured to use the VPN for only specific subnets - for example, Subnet A. The part I don't understand is why you want to NAT on your ASA's internal interface to a host on subnet B. Why don't you have Router 2 perform the NAT?

As far as the traffic routing, I can't answer that factually. However, I can say that NAT'ing in traditional implimentations causes two routing decisions. The first to identify the packet as belonging to a translated TCP connection - this will use the un translated IP addresses, and a following decision for the post-translated packet.

Basically, what do you mean by "Will this affect the connections coming in over the VPN?" Would you like remote, VPN-connected users to access the host on subnet-B via the NAT translation or not?

Assuming your goal is to make the host on subnet-B available to VPN users without exposing the rest of subnet-B to them, then your reasoning is sound; due to a lack of expierence on the cisco pix/asa platform, I can't guarantee that there aren't any gotcha's or hangups. This is readily and easily achievable using linux iptables, for examples.

Again, though, if you simply want to make the host on Subnet-B available to users over the VPN, then consider doing that NAT on Router 2 and/or adding Subnet-B to the VPN and using firewall rules on either the ASA or Router 2 to limit the traffic.

Sorry this isn't a perfect answer, but if you could clear up the details I may have some better news for you.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.