What is NAT exemption for a VPN, and what happens if you forget it?
Show the answer
Say this first
On IOS and most firewalls, outbound NAT happens before the packet is checked against the VPN policy. If LAN-to-LAN traffic is translated to the public address first, it no longer matches the crypto ACL or proxy ID and leaves unencrypted, where it is lost. NAT exemption is a rule that says traffic from my LAN to the remote LAN is not translated. Forget it on one side and you get a tunnel that is up with traffic flowing in one direction only.
Go deeper
IOS
ip access-list extended NAT-ACL
10 deny ip 10.1.0.0 0.0.0.255 10.2.0.0 0.0.0.255
20 permit ip 10.1.0.0 0.0.0.255 any
ip nat inside source list NAT-ACL interface GigabitEthernet0/0/0 overloadThe deny line must come before the permit. A standard ACL cannot do this because it cannot match on destination.
Why a VTI mostly avoids it
With a VTI, VPN traffic exits through Tunnel0. Tunnel0 is not an ip nat outside interface, so the
PAT rule on Gi0/0/0 never applies to it.
The symptom
| Router | encaps | decaps |
|---|---|---|
| Side with exemption | rising | 0 |
| Side without exemption | 0 | rising |
show ip nat translations on the broken side shows entries whose outside address is in the remote
LAN.
Firewalls
On a Cisco ASA it is identity NAT, for example
nat (inside,outside) source static LAN LAN destination static REMOTE REMOTE no-proxy-arp route-lookup.
On zone-based firewalls with route-based tunnels, putting the tunnel interface in its own zone keeps
the internet source NAT rule from matching.
They will ask next
You added the deny line, but some users still fail. Why?
Existing translations stay in the table and keep being used until they time out. Clear them with
clear ip nat translation *, which briefly disturbs every NATed flow, or wait for them to age out.Why is it one way instead of fully broken?
The side with the exemption encrypts correctly and the peer decrypts and delivers. The replies hit PAT on the side without the exemption, leave in clear toward a private address and are dropped. So one router sees encaps and no decaps, and the other the reverse.
Traps
- Putting the deny line after the permit line. ACLs are read top down, so it never matches.