Yesterday, I received a task at work to resolve an VPN issue. It wasn’t a straight forward solution. The client want to create a new internet link via a new ASA firewall to connect to a pptp sitting inside of the network. The default route is still going to their old internet link. One suggestion is to create a double nat environment, but how? Thanks for GNS3, I have created a lab using GNS3 with ASA and Cisco 7200 to simulate the situation and was able to find a solution.
So what need to be done is to create double NAT on the ASA, in this way, I don’t have to change the default route.
C1 is the VPN Client, R1 is the ISP router, ASA is the firewall, R2 is the Core Switch and R3 is the PPTP server.
here are the interface configurations:
R1 G1/0 : 222.111.111.1
R1 G2/0 : 233.111.111.254
C1 : 233.111.111.5
ASA: G1/0 : 222.111.111.2 (Ouside)
ASA: G2/0 : 192.168.2.1 (Inside)
ASA NAT POOL : 192.168.11.1 – 192.168.11.254
R2: G1/0 : 192.168.2.2
R2: G2/0 : 192.168.10.1
R3: G1/0 : 192.168.10.18 (PPTP SERVER)
R3: VPN POOL : 192.168.5.1 – 195.168.5.254
R1 Configuration
int gi1/0
ip add 222.111.111.1 255.255.255.252
int gi2/0
ip add 233.111.111.254 255.255.255.0
R2 Configuration
int gi1/0
ip add 192.168.2.2 255.255.255.252
int gi2/0
ip add 192.168.10.1 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.2.1
R3 Configuration
int gi1/0
ip add 192.168.10.18 255.255.255.0
ip route 0.0.0.0 0.0.0.0 192.168.10.1
aaa new-model
aaa authentication login VPNAUTHEN local
aaa authorization network VPNAUTHOR local
vpdn-group 1
! Default PPTP VPDN group
accept-dialin
protocol pptp
virtual-template 1
l2tp tunnel timeout no-session 15
interface Virtual-Template1
ip address 192.168.5.1 255.255.255.0
peer default ip address pool vpnpool
no keepalive
ppp authentication pap chap ms-chap ms-chap-v2
!
ip local pool vpnpool 192.168.5.2 192.168.5.255
ASA
interface GigabitEthernet0
nameif Outside
security-level 0
ip address 222.111.111.2 255.255.255.252
!
interface GigabitEthernet1
nameif Inside
security-level 100
ip address 192.168.2.1 255.255.255.252
!
object network pptp_inside
host 192.168.10.18
object network NAT_POOL
range 192.168.11.1 192.168.11.254
object service pptp
service tcp destination eq pptp
object network Inside-network
subnet 192.168.0.0 255.255.0.0
access-list Outside_access_in extended permit ip any any
access-list Inside_access_in extended permit ip any any
nat (Outside,Inside) source dynamic any NAT_POOL destination static interface pptp_inside service pptp pptp
access-group Outside_access_in in interface Outside
access-group Inside_access_in in interface Inside
route Outside 0.0.0.0 0.0.0.0 222.111.111.1 1
route Inside 192.168.0.0 255.255.0.0 192.168.2.2 1
!
policy-map global-policy
class class-default
inspect pptp
set connection advanced-options tcp-state-bypass
!
service-policy global-policy global
What I want to achieve is from VPN Client (0.0.0.0) to connect (222.111.111.2), it will be translated to (192.168.11.x) and connect to 192.168.10.18. PPTP will be able to setup, while it won’t be affect people connect via the existing internet link.
