SA540 - IPSec and NAT

Question

Here's the scenario
My LAN 10.10.10.0
Local Host 10.10.10.6
Remote LAN: 192.168.201.0
Remote Host: 192.168.201.59
Trying to setup a IPSec connection between two hosts.
The other side wants to me to NAT 10.10.10.6 as 172.16.5.6
The SA540 doesn't seem to have this feature.
Is there a way to easily achieve that?
Thank you

Answer 1

Here is example, which might help you but you need to make sure you have the matching subnet (for bidirectional - one to one mapping)
Configure the NAT.  Source address range of 10.9.0.0 / 24 and destinations of remote subnet (example 10.10.0.0/24)
access-list 101 permit ip 10.9.0.0 0.0.0.255 10.10.0.0 0.0.0.255
Create a route-map called 'static-nat' and match traffic to ACL 101:
route-map static-nat
  match ip address 101
Create a NAT-POOL for the public IP address (or range) you want to use to NAT to.  In this case, Im NAT'ing to 172.16.17.0:
ip nat pool NAT-POOL 172.16.17.1 172.16.17.254 netmask 255.255.255.0
Create a NAT rule to use the route-map 'static-nat'.  Upon a match to ACL 101, NAT that traffic to one of the NAT-POOL addresses:
ip nat inside source route-map static-nat pool NAT-POOL Overload
Once you have configured the NAT you need to modify the interesting traffic.  You need your 'interesting traffic' 
access-list 121 permit ip 172.16.17.0 0.0.0.255 10.10.0.0 0.0.0.255
Define your VPN peer, apply phase II and matching ACL for interesting traffic:
crypto map VPN 5 ipsec-isakmp
 set peer <peer ip>
 set transform-set <transform set>
 match address 121
Apply the crypto map to the public interface and NAT on the public side:
interface GigabitEthernet0/0
 ip nat outside
crypto map VPN
Configure the inside interface NAT on internal side:
interface GigabitEthernet0/1
 ip address 10.9.0.0 255.255.255.0
 ip nat inside
HTH