Nat Considerations For Intra-Interface Traffic - Cisco FirePOWER ASA 5500 series Configuration Manual

Chapter 29 Setting General IPSec VPN Parameters

NAT Considerations for Intra-Interface Traffic

For the security appliance to send unencrypted traffic back out through the interface, you must enable
NAT for the interface so that publicly routable addresses replace your private IP addresses (unless you
already use public IP addresses in your local IP address pool). The following example applies an
interface PAT rule to traffic sourced from the client IP pool:
hostname(config)# ip local pool clientpool 192.168.0.10-192.168.0.100
hostname(config)# global (outside) 1 interface
hostname(config)# nat (outside) 1 192.168.0.0 255.255.255.0
When the security appliance sends encrypted VPN traffic back out this same interface, however, NAT is
optional. The VPN-to-VPN hairpinning works with or without NAT. To apply NAT to all outgoing
traffic, implement only the commands above. To exempt the VPN-to-VPN traffic from NAT, add
commands (to the example above) that implement NAT exemption for VPN-to-VPN traffic, such as:
hostname(config)# access-list nonat permit ip 192.168.0.0 255.255.255.0 192.168.0.0
255.255.255.0
hostname(config)# nat (outside) 0 access-list nonat
For more information on NAT rules, see the "Applying NAT" chapter of this guide.
Setting Maximum Active IPSec VPN Sessions
To limit VPN sessions to a lower value than the security appliance allows, enter the vpn-sessiondb
max-session-limit command in global configuration mode.
•
•
The syntax is vpn-sessiondb max-session-limit {session-limit}.
The following example shows how to set a maximum VPN session limit of 450:
hostname (config)# vpn-sessiondb max-session-limit 450
hostname (config)#
Using Client Update to Ensure Acceptable Client Revision
Levels
The client update feature lets administrators at a central location automatically notify VPN client users
that it is time to update the VPN client software and the VPN 3002 hardware client image.
Remote users might be using outdated VPN software or hardware client versions. You can use the
client-update command at any time to enable updating client revisions; specify the types and revision
numbers of clients to which the update applies; provide a URL or IP address from which to get the
update; and, in the case of Windows clients, optionally notify users that they should update their VPN
client version. For Windows clients, you can provide a mechanism for users to accomplish that update.
For VPN 3002 hardware client users, the update occurs automatically, with no notification. This
command applies only to the IPSec remote-access tunnel-group type.
OL-10088-01
This command applies to all types of VPN sessions, including WebVPN.
This limit affects the calculated load percentage for VPN Load Balancing.
Setting Maximum Active IPSec VPN Sessions
Cisco Security Appliance Command Line Configuration Guide
29-3