Site to site VPN NAT?

mattrgee

Hi all,

We are going to configure a site to site VPN between our company and some of our critical suppliers. This is mainly for support purposes.

Is it best practive to NAT their traffic as it enters our network? If not, it seems odd to allow traffic from various IP ranges to pass around our network. This is assuming non of their native ip ranges overlap.

We will also need to add some routes to direct the return traffic back to the ASA. I suspect without NAT'ing we'll end up various routes for various subnets all pointing back to the inside address of the ASA. This seems messy.

Any suggestions?

Thanks.

mikearama

If you want to avoid the addition of the extra routes, then go with a NAT/PAT solution. Make it a unique PAT, ie, one per vendor, so you can still lock-down their access. We, early on, made the mistake of giving all our vendors the same PAT'ted IP, and then when one needed a port opened, they all got it.

Conversely, thinking about our vendors, they all use completely different addressing schemes than we do. It wouldn't have been a big job to add a class B route to our core routers for the few vendors we have.

mattrgee

Thanks a lot. That sounds very sensible.