PIX 501: NAT VPN Clients to Inside?

Ok. What I want to do seems quite simple, but whatever I just can't
quite get the pieces to mesh. I have a pix 501 that I'm trying to
configure to provide VPN access to our local network for clients
running the Cisco VPN client 4.x.

Our network is seperated into VLANS, but uses public IP's for most
machines. I'll use fake numbers for my examples though. The Outside
interface has a public IP of 172.46.32.100. This is connected to our
DMZ VLAN. The "Inside" interface has a public IP of 172.46.24.100,
which is connected to a separate VLAN.

What I want to do is have the VPN clients connect to the outside
interface, get a private IP (from 192.168.2.0/24) and then be NAT'd
(PAT) to the inside interface IP of 172.46.24.100. That way, the
routing meshes with everything because all the VPN client traffic
would appear to come from the interface IP of the pix. In all the
various permutations of configurations I've done, it ends up with the
client computer connecting, getting a 192.168 address, and then it
merely passes through the IP un-NAT'd (i.e., the servers on the local
network see connections coming in from 192.168.2.x). I can make this
work by adding static routes to direct traffic destined for
192.168.2.x to the PIX, but I'd rather have it just NAT everything to
make things cleaner.
.

Relevant Pages

  • Re: [fw-wiz] Pix VPN endpoint and split-tunnel
    ... forward the packet back out the same interface it was received. ... If you are running PIX OS 6.3., it is a correct statement that you ... >>would like to force the client to use the corporate network for ... >of anything the PIX or VPN client do. ...
    (Firewall-Wizards)
  • Pix VPN and routing
    ... "computer" has some arbitrary IP address and Cisco's VPN client. ... interface for encryption should be sent towards the outside interface after ... Pix 515 with software 7.0. ...
    (comp.dcom.sys.cisco)
  • Re: PIX 501 CISCO vpn problem
    ... :command on my pix 506e that allowed port 4500 or somthing. ... connect through a VPN client to a device -behind- the PIX 501? ... configured ssh access to the 501 and tried ssh'ing to it? ... tried connecting to the 501 via pdm? ...
    (comp.dcom.sys.cisco)
  • RE: [fw-wiz] IP migration on "hub" VPN terminus [long]
    ... > add necessary statements for Cisco Secure VPN client to ... and telnet into the remote pix. ... Telnet on its outside interface, ... > of the VPN client connecting with DES encryption; ...
    (Firewall-Wizards)
  • RE: [fw-wiz] IP migration on "hub" VPN terminus [long]
    ... > add necessary statements for Cisco Secure VPN client to connect ... and telnet into the remote pix. ... connected to the PIX via VPN client and connecting to it via Telnet on its ...
    (Firewall-Wizards)