NAT above 8.3+

Question

I am a little confused on the new nat.
I have a VPN tunnel from a vendor that I would like to have their local address set to A NAT address because it conflicts with my network address. And also would like my inside host address NAT to another address. Reason is I will be changing my inside network address scheme in the near future and would be easier to change the address in my Firewall then contact all the vendors. This NAT only needs to happen when contacting this VPN tunnel or any other tunnels in the future. I also put in some public addresses. I dont think I needed they exept for the VPN stage but just in case I am forgetting something.
HQ Inside: Public 192.192.1.214
A     SRC-REAL-HQ-IN:         host 10.120.40.50
B     DST-MAPPED-HQ-NAT: host 172.29.20.50  
Vendor:  Public 11.11.25.6
C     SRC-REAL-VEN-OUT:      host 10.1.1.6
D     DST-MAPPED-VEN-NAT: host 172.29.10.10
object network A
host 10.120.40.50
object network B
host 172.29.20.50
object network C
host 10.1.1.6
object network D
host 172.29.10.10
Where I am stuck:
?  nat (in,out) source static A D destination static B C   ?
Or am I doing this all wrong? Is there another way to map the address together?

Answer 1

Hi,
I understood that you want to do NAT for both the source and destination addresses because the remote networks overlaps with your local network.
The configuration format for such a NAT would be
nat (in,out) source static destiantion static
The above configuration would work in the following way
Traffic destined to would arrive on the firewall and the would get UN-NAT / untranslated to
The connections would get mapped to the
With regards to the L2L VPN configurations your Crypto ACL would have to match the and to the 2 configurations would match.
Hope this helps
- Jouni