We have a Cisco 1921 router running IOS 15.1 at one of our branches which is connected via a L2L IPsec VPN to a ASA5510 running ASA 8.2 at our headquarters.
The network looks something like this:
192.168.14.0/24 - RT - Internet - ASA - 192.168.10.0/24
|----L2L VPN----|
RT has NAT configured to let the local users there access the internet. The configuration looks like this:
crypto isakmp policy 10 encr aes authentication pre-share group 2 crypto isakmp key SECRETKEY address HQ_ASA_IP ! ! crypto ipsec transform-set ESP-AES-SHA esp-aes esp-sha-hmac ! crypto map outside_map 10 ipsec-isakmp set peer HQ_ASA_IP set transform-set ESP-AES-SHA match address 120 ! interface GigabitEthernet0/0 ip address 192.168.14.252 255.255.255.0 ip nat inside ip virtual-reassembly in duplex auto speed auto no mop enabled ! interface Dialer0 mtu 1492 ip address negotiated ip access-group 101 in ip nat outside ip virtual-reassembly in encapsulation ppp ip tcp adjust-mss 1452 dialer pool 1 dialer-group 1 ppp authentication chap callin ppp chap hostname SECRETUSERNAME ppp chap password 0 SECRETPASSWORD ppp pap sent-username SECRETUSERNAME password 0 SECRETPASSWORD crypto map outside_map ! ip nat inside source route-map nonat interface Dialer0 overload route-map nonat permit 10 match ip address 110 ! access-list 110 deny ip 192.168.8.0 0.0.7.255 192.168.8.0 0.0.7.255 access-list 110 permit ip 192.168.14.0 0.0.0.255 any access-list 120 permit ip 192.168.14.0 0.0.0.255 192.168.8.0 0.0.7.255 access-list 120 permit ip 192.168.8.0 0.0.7.255 192.168.14.0 0.0.0.255
Now we have a service which needs to be accessed from the internet on one of the hosts within the 192.168.14.0/24 network and have configured a port forwarding using the following command:
ip nat inside source static tcp 192.168.14.7 8181 EXT_IP 31337 extendable
The forwarding works and the service can be accessed via EXT_IP:1337 but we can no longer access 192.168.14.7:8181 via VPN from the 192.168.10.0/24 network while this worked just fine before the forwarding was in place.
Any hint on what I'm missing or why this behaves in such a way would be very much appreciated.
