Cisco ASA 5505 Configuration Manual page 1357

Chapter 64 General VPN Setup
–
Click OK.
d.
Click Apply. Your rule should look like rule two in the
e.
page
CLI example
nat source static inside-network inside-network destination static Engineering-VPN
Engineering-VPN
Create a new rule, following the method in
Step 6
the Engineering VPN address pool and the DMZ network. Use the DMZ network as the Source Address
and use the Engineering VPN address pool as the Destination address.
Create a new NAT rule to allow the Engineering VPN address pool to access the Internet through the
Step 7
tunnel. In this case, you do not want to use identity NAT because you want to change the source address
from a private address to an Internet routable address. To create this rule, follow this procedure:
In the NAT Rules pane, select Add > Add NAT Rule Before "Network Object" NAT rules so that
a.
this rule will be processed before other rules.
In the Match criteria: Original Packet area configure these fields:
b.
–
–
–
–
In the Action: Translated Packet area, configure these fields:
c.
–
–
–
–
In the Options area, configure these fields:
d.
–
–
–
–
Click OK.
e.
Click Apply. Your rule should look like rule five in the
f.
page
CLI example:
nat (any,outside) source dynamic Engineering-VPN interface
OL-20339-01
Description: Add a Description for this rule.
64-48.
Source Interface: Any
Destination Interface: Any. This field will be automatically populated with "outside" after you
select outside as the Source Address in the Action: Translated Packet area.
Source Address: Click the Source Address browse button and select the network object that
represents the Engineering VPN address pool.
Destination Address: Any.
Source NAT Type: Dynamic PAT (Hide)
Source Address: Click the Source Address browse button and select the outside interface.
Destination Address: Original
Service: Original
Check Enable rule.
Uncheck or leave empty the Translate DNS replies that match this rule.
Direction: Both
Description: Add a Description for this rule.
64-48.
Configuring AnyConnect (SSL) VPN Client Connections
Unified NAT table
Step 5, to configure identity NAT for the connection between
Unified NAT table
Cisco ASA 5500 Series Configuration Guide using ASDM
in Figure 64-5 on
in Figure 64-5 on
64-47