RemoteSite   (172.16.1.*)
 Internet --- InternetUsers
   ASA --- LocalUsers (192.168.1.*)
 InsideNet     (10.1.1.*)
 DeeperNet     (10.22.22.*)

I have a Cisco ASA 5510 with three interfaces, inside/outside/localusers.

On the inside there are two subnets, InsideNet and DeeperNet, connected by a simple router. The ASA's routing table has an entry for DeeperNet.

The remote sites connects via a lan-to-lan VPN on the outside interface. (This VPN includes InsideNet and DeeperNet, so a user from RemoteSite can contact servers on DeeperNet)

All Traffic to a web server on InsideNet ( needs to be redirected to a web server on Deepernet ( For localusers this is easily done with a static NAT rule:

static (inside,localusers) netmask

Any traffic from internet users comes to the public IP of the ASA, and is also easy to handled with a static NAT rule.

static (inside,outside) netmask

Where I'm having problems is with the VPN users. I'm not sure exactly how the VPN functionality interacts with NAT, and what order NAT & VPN get applied to an ASA.

How do I configure a static NAT rule so any RemoteUsers sending data to over the VPN have it redirected to

Does this NAT take effect before or after VPN traffic selection? (that is, if the VPN was configured as RemoteSite<-> InsideNet only would traffic to come through and be NATTed to the DeeperNet IP, or would the ASA look at the real IPs and decide it's not part of the VPN?)


From experience, I belive NAT gets applied before VPNs. I've only dealt with infrastructure VPNs though, which may be different to VPN users.

  • this is a lan-to-lan VPN, which I assume is what you mean by "infrastructure VPN" - were you using cisco gear when you made thos eobservations? I know Cisco does NAT & firewall in the opposite order to iptables, so any other vendors won't be a good comparison here.
    – DrStalker
    Aug 31 '09 at 6:56
  • Yep. Using a PIX 506 (I think).
    – Cian
    Aug 31 '09 at 7:06

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.