I am trying to setup our ASA 5510 to allow IPsec(IKEv1) access to the inside network through VPN. The hard part about our setup is the outside interface does not have a public IP address assigned to it.

Current setup: Router -> ASA

In between the Router and ASA is a private network. All public IPs are assigned from the ASA to the host on the DMZ.

So I first attempted setting up one of the free public IPs on the ASA. This was setup with a sub interface of 2 and vlan 1 on the outside interface. Then I setup VPN to work over the new interface and that didn’t seem to work. So I wasn’t sure what the best way of setting up remote VPN access with the ASA when the ASA doesn’t have any public IPs. Any thoughts would be very helpful.

  • Can you clarify the relationship of the router to the ASA? Is it just routing traffic over the private net, and having the ASA do the NAT work? – Shane Madden Jan 6 '12 at 0:54
  • Correct. The router is pretty dumb in the sense. It passes all traffic and does no natting. – user106104 Jan 6 '12 at 1:06
  • You're saying that the router does not perform NAT, yet your ASA has a private IP on the outside. It doesn't make any sense.. is there another device that does the NAT'ing? – pauska Jan 6 '12 at 15:06
  • Give us your Topology to make it clear. – cuonglm Jun 15 '13 at 1:09

Your topology is Router -> ASA and you need the ASA to have an effective public IP for VPN clients to connect to it.

This requires a one-to-one NAT to give the ASA an effective public IP.

Cisco has a pretty good rundown on how to configure NAT on their routers: http://www.cisco.com/en/US/tech/tk648/tk361/technologies_tech_note09186a0080093f31.shtml

If you don't have a Cisco router then you'll need to get the documentation for configuring static or one-to-one NAT on the router. If you don't control the router you will need to request a one-to-one NAT from the administrator who does.


IPsec, and perhaps IKEv1, doesn't work especially well over NAT. Even with 1:1 NAT, the packets are mangled, and the signatures will fail. There are processes (including for IKEv1, and on the ASA) to help this to work, in theory solving the problems, but the chances of it working in the wild with multiple vendors products is pretty close to 0.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.