Cisco Systems - page 1553

69-51
Cisco ASA 5500 Series Configuration Guide using ASDM
Chapter69 General VPN Setup
Configuring AnyConnect VPN Client Connections
– Description: Add a Description for this rule.
d. Click OK.
e. Click Apply. Your rule should look like rule two in the Unified NAT table in Figure 69-5 on
page 69-52.
CLI example
nat source static inside-network inside-network destination static Engineering-VPN
Engineering-VPN
Step6 Create a new rule, following the method in Step5, to configure identity NAT for the connection between
the Engineering VPN address pool and the DMZ network. Use the DMZ network as the Source Address
and use the Engineering VPN address pool as the Destination address.
Step7 Create a new NAT rule to allow the Engineering VPN address pool to access the Internet through the
tunnel. In this case, you do not want to use identity NAT because you want to change the source address
from a private address to an Internet routable address. To create this rule, follow this procedure:
a. In the NAT Rules pane, select Add > Add NAT Rule Before “Network Object” NAT rules so that
this rule will be processed before other rules.
b. In the Match criteria: Original Packet area configure these fields:
– Source Interface: Any
– Destination Interface: Any. This field will be automatically populated with “outside” after you
select outside as the Source Address in the Action: Translated Packet area.
– Source Address: Click the Source Address browse button and select the network object that
represents the Engineering VPN address pool.
– Destination Address: Any.
c. In the Action: Translated Packet area, configure these fields:
– Source NAT Type: Dynamic PAT (Hide)
– Source Address: Click the Source Address browse button and select the outside interface.
– Destination Address: Original
– Service: Original
d. In the Options area, configure these fields:
– Check Enable rule.
– Uncheck or leave empty the Translate DNS replies that match this rule.
– Direction: Both
– Description: Add a Description for this rule.
e. Click OK.
f. Click Apply. Your rule should look like rule five in the Unified NAT table in Figure69-5 on
page 69-52.
CLI example:
nat (any,outside) source dynamic Engineering-VPN interface