{"id":818,"date":"2013-12-01T00:00:00","date_gmt":"2013-12-01T00:00:00","guid":{"rendered":"https:\/\/fir3netwp.gmsrrpobkbd.com\/2013\/12\/01\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80\/"},"modified":"2023-01-15T23:01:11","modified_gmt":"2023-01-15T23:01:11","slug":"configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80","status":"publish","type":"post","link":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html","title":{"rendered":"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0"},"content":{"rendered":"<p>&nbsp;<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_65 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\">Table of Contents<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-662f2ec0d3664\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\"  id=\"ez-toc-cssicon-toggle-item-662f2ec0d3664\"  aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Purpose\" title=\"Purpose\">Purpose<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Terms\" title=\"Terms\">Terms<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Example\" title=\"Example\">Example<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Topology\" title=\"Topology\">Topology<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Configuration\" title=\"Configuration\">Configuration<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Site_A_ASA_84\" title=\"Site A (ASA 8.4)\">Site A (ASA 8.4)<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#VPN\" title=\"VPN\">VPN<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#NAT\" title=\"NAT\">NAT<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Site_B_ASA_80\" title=\"Site B (ASA 8.0)\">Site B (ASA 8.0)<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#VPN-2\" title=\"VPN\">VPN<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Hairpin\" title=\"Hairpin\">Hairpin<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#NAT-2\" title=\"NAT\">NAT<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Site_C_Vyatta\" title=\"Site C (Vyatta)\">Site C (Vyatta)<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#VPN-3\" title=\"VPN\">VPN<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#NAT-3\" title=\"NAT\">NAT<\/a><\/li><\/ul><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#NAT_Exemption\" title=\"NAT Exemption\">NAT Exemption<\/a><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><ul class='ez-toc-list-level-4' ><li class='ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Problem\" title=\"Problem\">Problem<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-4'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\/#Workaround\" title=\"Workaround\">Workaround<\/a><\/li><\/ul><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2 class=\"h3\"><span class=\"ez-toc-section\" id=\"Purpose\"><\/span><strong>Purpose<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA firewall (running 8.0).<\/p>\n<h2 class=\"h3\"><span class=\"ez-toc-section\" id=\"Terms\"><\/span><strong>Terms<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Within this article there are 2 key terms that you will need to know. They are,<\/p>\n<ul>\n<li><strong>Hairpinning (U-turn Traffic)<\/strong> &#8211; Hairpinning is a term to describe traffic that is routed out of the same interface from which it entered.<\/li>\n<li><strong>Double NAT (Twice NAT)<\/strong> &#8211; Double NAT is a term used to describe the translation of both the source and destination address on a single traffic flow. Though not set in stone, your`ll &#8220;typically&#8221; find that the term Double NAT is used across the code base all the way up to 8.2. Whereas <a href=\"https:\/\/www.fir3net.com\/Cisco-ASA\/cisco-asa-twice-nat.html\">Twice NAT<\/a> is typically used within the 8.3+ code base.<\/li>\n<\/ul>\n<h2 class=\"h3\"><span class=\"ez-toc-section\" id=\"Example\"><\/span><strong>Example<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Within this example we will send traffic from Site-A to Site-C via Site-B across 2 VPN`s. Site-B will translate both the source address and destination address before sending the traffic onto Site-C.<\/p>\n<p>The IP\/encryption domain details are :<\/p>\n<p><strong>Site-A to Site-B VPN<\/strong><\/p>\n<table class=\"table\">\n<tbody>\n<tr>\n<td><strong>PEER<\/strong><\/td>\n<td><strong>PEER IP<\/strong><\/td>\n<td><strong>LOCAL ENDPOINT<\/strong><\/td>\n<td><strong>REMOTE ENDPOINT<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Site-A<\/td>\n<td>1.1.1.1<\/td>\n<td>192.168.10.1\/32<\/td>\n<td>172.16.30.1\/32<\/td>\n<\/tr>\n<tr>\n<td>Site-B<\/td>\n<td>2.2.2.2<\/td>\n<td>172.16.30.1\/32<\/td>\n<td>192.168.10.1\/32<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p><strong>Site-B to Site-C VPN<\/strong><\/p>\n<table class=\"table\">\n<tbody>\n<tr>\n<td><strong>PEER<\/strong><\/td>\n<td><strong>PEER IP<\/strong><\/td>\n<td><strong>LOCAL ENDPOINT<\/strong><\/td>\n<td><strong>REMOTE ENDPOINT<\/strong><\/td>\n<\/tr>\n<tr>\n<td>Site-B<\/td>\n<td>2.2.2.2<\/td>\n<td>2.2.2.20\/32<\/td>\n<td>192.168.30.1\/32<\/td>\n<\/tr>\n<tr>\n<td>Site-C<\/td>\n<td>3.3.3.3<\/td>\n<td>192.168.30.1\/32<\/td>\n<td>2.2.2.20\/32<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>To make things slightly more interesting this example has been built using the following platforms\/versions,<\/p>\n<ul>\n<li><strong>Site-A<\/strong> &#8211; Cisco ASA 8.4<\/li>\n<li><strong>Site-B<\/strong> &#8211; Cisco ASA 8.0(4)28<\/li>\n<li><strong>Site-C<\/strong> &#8211; Vyatta VC6.5R1<\/li>\n<\/ul>\n<h2 class=\"h3\"><span class=\"ez-toc-section\" id=\"Topology\"><\/span><strong>Topology<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Below shows the topology for our example,<\/p>\n<h2 class=\"h3\"><span class=\"ez-toc-section\" id=\"Configuration\"><\/span><strong>Configuration<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Lets look at the configuration steps.<\/p>\n<p>The configuration (VPN and NAT) for all 3 sites has been included. However, though the configuration is provided for all 3 sites, the core configuration resides on Site-B (due to Site-B performing both the hairpinning and the double NAT).<strong><br \/>\n<\/strong><\/p>\n<h3><span class=\"ez-toc-section\" id=\"Site_A_ASA_84\"><\/span><strong>Site A (ASA 8.4)<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>On Site-A a standard site to site VPN is configured along with a NAT exemption.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"VPN\"><\/span><strong>VPN<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<pre class=\"prettyprint\">tunnel-group 2.2.2.2 type ipsec-l2l\r\ntunnel-group 2.2.2.2 ipsec-attributes\r\n\u00a0ikev1 pre-shared-key abc123<\/pre>\n<p>access-list ENCDOM100 extended permit ip host 192.168.10.1 host 172.16.30.1<\/p>\n<p>crypto ipsec ikev1 transform-set ESP-3DES esp-3des esp-sha-hmac<br \/>\ncrypto map outside 100 match address ENCDOM100<br \/>\ncrypto map outside 100 set peer 2.2.2.2<br \/>\ncrypto map outside 100 set ikev1 transform-set ESP-3DES<br \/>\ncrypto map outside 100 set security-association lifetime seconds 86400<br \/>\ncrypto map outside interface outside<\/p>\n<p>crypto isakmp identity address<br \/>\ncrypto ikev1 enable outside<br \/>\ncrypto ikev1 policy 10<br \/>\nauthentication pre-share<br \/>\nencryption aes<br \/>\nhash md5<br \/>\ngroup 2<br \/>\nlifetime 86400<\/p>\n<h4><span class=\"ez-toc-section\" id=\"NAT\"><\/span><strong>NAT<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<pre class=\"prettyprint\">object-group network REMOTE-ENCDOM\r\n\u00a0network-object host 172.16.30.1\r\nobject-group network LOCAL-ENCDOM\r\n\u00a0network-object host 192.168.10.1<\/pre>\n<p>nat (inside,outside) source static LOCAL-ENCDOM LOCAL-ENCDOM destination static REMOTE-ENCDOM REMOTE-ENCDOM no-proxy-arp<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Site_B_ASA_80\"><\/span><strong>Site B (ASA 8.0)<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>As previously mentioned the core of the configuration resides on Site-B. 2 x Site to Site VPN`s are configured, hairpinning enabled and then the double NAT is configured via 2 policy NATs.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"VPN-2\"><\/span><strong>VPN<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<pre class=\"prettyprint\">tunnel-group 1.1.1.1 type ipsec-l2l\r\ntunnel-group 1.1.1.1 ipsec-attributes\r\n\u00a0pre-shared-key abc123\r\ntunnel-group 3.3.3.3 type ipsec-l2l\r\ntunnel-group 3.3.3.3 ipsec-attributes\r\n\u00a0pre-shared-key abc123<\/pre>\n<p>access-list ENCDOM100 extended permit ip host 172.16.30.1 host 192.168.10.1<br \/>\naccess-list ENCDOM101 extended permit ip host 2.2.2.20 host 192.168.30.1<\/p>\n<p>crypto ipsec transform-set ESP-3DES esp-3des esp-sha-hmac<br \/>\ncrypto ipsec security-association lifetime seconds 28800<br \/>\ncrypto map outside 100 match address ENCDOM100<br \/>\ncrypto map outside 100 set peer 1.1.1.1<br \/>\ncrypto map outside 100 set transform-set ESP-3DES<br \/>\ncrypto map outside 100 set security-association lifetime seconds 86400<br \/>\ncrypto map outside 101 match address ENCDOM101<br \/>\ncrypto map outside 101 set pfs<br \/>\ncrypto map outside 101 set peer 3.3.3.3<br \/>\ncrypto map outside 101 set transform-set ESP-3DES<br \/>\ncrypto map outside 101 set security-association lifetime seconds 86400<br \/>\ncrypto map outside interface outside<\/p>\n<p>crypto isakmp identity address<br \/>\ncrypto isakmp enable outside<br \/>\ncrypto isakmp policy 10<br \/>\nauthentication pre-share<br \/>\nencryption aes<br \/>\nhash md5<br \/>\ngroup 2<br \/>\nlifetime 86400<\/p>\n<h4><span class=\"ez-toc-section\" id=\"Hairpin\"><\/span><strong>Hairpin<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>To permit traffic flows that come in on an interface and is routed back out the same interface the following command is used,<\/p>\n<pre class=\"prettyprint\">same-security-traffic permit intra-interface<\/pre>\n<h4><span class=\"ez-toc-section\" id=\"NAT-2\"><\/span><strong>NAT<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>Finally we perform a double NAT on our traffic. This is achieved via 2 policy NATs. The first translates the source address, the 2nd translates the destination.<\/p>\n<pre>access-list POLICYNAT-1 extended permit ip host <span style=\"color: #ff0000;\">192.168.10.1<\/span> host 172.16.30.1\r\nstatic (<span style=\"color: #ff0000;\">outside<\/span>,<span style=\"color: #0000ff;\">outside<\/span>) <span style=\"color: #0000ff;\">2.2.2.20<\/span> access-list POLICYNAT-1<\/pre>\n<p>access-list POLICYNAT-2 extended permit ip host <span style=\"color: #ff0000;\">192.168.30.1<\/span> host 2.2.2.20<br \/>\nstatic (<span style=\"color: #ff0000;\">outside<\/span>,<span style=\"color: #0000ff;\">outside<\/span>) <span style=\"color: #0000ff;\">172.16.30.1<\/span> access-list POLICYNAT-2<\/p>\n<p>Lets look at this in some more detail,<\/p>\n<ul>\n<li><strong> POLICYNAT-1<\/strong> &#8211; Translates the <strong>source<\/strong> address.\n<ul>\n<li style=\"list-style-type: none;\">\n<ul>\n<li>The NAT entry reads. When traffic destined for 172.16.30.1 with a source address of 192.168.10.1 hits the outside interface. The source address will be translated to 2.2.2.20.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<li><strong>POLICYNAT-2<\/strong> &#8211; Translates the <strong>destination<\/strong> address.\n<ul style=\"list-style-type: square;\">\n<li style=\"list-style-type: none;\">\n<ul style=\"list-style-type: square;\">\n<li>As we want to NAT the destination when the source address is 2.2.2.20, POLICYNAT-2 reads slighty differently to the previous NAT statement. The NAT entry reads. When traffic is destined for 192.168.30.1 with a source IP of 2.2.2.20 on the outside interface translate the destination address to 192.168.30.1.<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n<p><em><strong>Note<\/strong><\/em> : You will need to ensure the NAT policies are ordered so that the source translation is first, followed by the destination. This is because of the NAT processing order.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Site_C_Vyatta\"><\/span><strong>Site C (Vyatta)<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>For Site C, again the configuration is pretty standard. A <a href=\"https:\/\/www.fir3net.com\/Routers\/Brocade\/vyatta-how-to-configure-a-policy-based-vpn.html\">site to site VPN<\/a> is built, and the NAT rules are configured to ensure NAT exemption.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"VPN-3\"><\/span><strong>VPN<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<pre class=\"prettyprint\">set vpn ipsec esp-group ESP-POLICY lifetime '28800'\r\nset vpn ipsec esp-group ESP-POLICY proposal 1 encryption '3des'\r\nset vpn ipsec esp-group ESP-POLICY proposal 1 hash 'sha1'\r\nset vpn ipsec ike-group IKE-POLICY lifetime '86400'\r\nset vpn ipsec ike-group IKE-POLICY proposal 1 dh-group '2'\r\nset vpn ipsec ike-group IKE-POLICY proposal 1 encryption 'aes128'\r\nset vpn ipsec ike-group IKE-POLICY proposal 1 hash 'md5'<\/pre>\n<p>set vpn ipsec ipsec-interfaces interface &#8216;eth0&#8217;<\/p>\n<p>set vpn ipsec site-to-site peer 2.2.2.2 authentication mode &#8216;pre-shared-secret&#8217;<br \/>\nset vpn ipsec site-to-site peer 2.2.2.2 authentication pre-shared-secret &#8216;abc123&#8217;<br \/>\nset vpn ipsec site-to-site peer 2.2.2.2 default-esp-group &#8216;ESP-POLICY&#8217;<br \/>\nset vpn ipsec site-to-site peer 2.2.2.2 ike-group &#8216;IKE-POLICY&#8217;<br \/>\nset vpn ipsec site-to-site peer 2.2.2.2 local-address &#8216;3.3.3.3&#8217;<br \/>\nset vpn ipsec site-to-site peer 2.2.2.2 tunnel 1 local prefix &#8216;192.168.30.1\/32&#8217;<br \/>\nset vpn ipsec site-to-site peer 2.2.2.2 tunnel 1 remote prefix &#8216;2.2.2.20\/32&#8217;<\/p>\n<h4><span class=\"ez-toc-section\" id=\"NAT-3\"><\/span><strong>NAT<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<pre class=\"prettyprint\">set nat source rule 10 destination address '192.168.30.1\/32'\r\nset nat source rule 10 'exclude'\r\nset nat source rule 10 outbound-interface 'eth0'\r\nset nat source rule 10 source address '2.2.2.20\/32'\r\nset nat source rule 20 destination address '2.2.2.20\/32'\r\nset nat source rule 20 'exclude'\r\nset nat source rule 20 outbound-interface 'eth0'\r\nset nat source rule 20 source address '192.168.30.1\/32'<\/pre>\n<h2 class=\"h3\"><span class=\"ez-toc-section\" id=\"NAT_Exemption\"><\/span><strong>NAT Exemption<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h2>\n<h4><span class=\"ez-toc-section\" id=\"Problem\"><\/span><strong>Problem<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>The main problem\u00a0you may face when using policy NAT is when you already have NAT exemption (i.e no NAT) rules in place for the your traffic. This is an issue because NAT exemption is processed before any other type of NAT. Resulting in the policy NAT statements negated.<\/p>\n<h4><span class=\"ez-toc-section\" id=\"Workaround\"><\/span><strong>Workaround<\/strong><span class=\"ez-toc-section-end\"><\/span><\/h4>\n<p>To workaround this problem add a deny statement to your no NAT ACL so that the traffic negates the no NAT and the policy NAT is triggered.<\/p>\n<pre class=\"prettyprint\">access-list nonat deny ip host 192.168.10.1 host 172.16.30.1<\/pre>\n<p><em><strong>Note <\/strong>: <\/em><\/p>\n<ul>\n<li><em>At the point you add the deny statement to your no NAT ACL, ensure that you also clear the relating xlate entries.<\/em><\/li>\n<li><em>Its also good to know that,<\/em>\n<ul style=\"list-style-type: square;\">\n<li><em>No NAT ACL`s <span style=\"text-decoration: underline;\">can<\/span> contain deny entries, but <span style=\"text-decoration: underline;\">cannot<\/span> contain ports\/protocols. <\/em><\/li>\n<li><em>Policy NAT ACLs <span style=\"text-decoration: underline;\">cannot<\/span> contain deny statements, but <span style=\"text-decoration: underline;\">can<\/span> contain ports\/protocols.<\/em><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA firewall (running 8.0). Terms Within this article there are 2 key terms that you will need to know. They are, Hairpinning (U-turn Traffic) &#8211; Hairpinning is a term to &#8230; <a title=\"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0\" class=\"read-more\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\" aria-label=\"Read more about Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0\">Read more<\/a><\/p>\n","protected":false},"author":2,"featured_media":817,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11],"tags":[],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v22.5 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0 - Fir3net<\/title>\n<meta name=\"description\" content=\"&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0 - Fir3net\" \/>\n<meta property=\"og:description\" content=\"&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\" \/>\n<meta property=\"og:site_name\" content=\"Fir3net\" \/>\n<meta property=\"article:published_time\" content=\"2013-12-01T00:00:00+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-15T23:01:11+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png\" \/>\n\t<meta property=\"og:image:width\" content=\"656\" \/>\n\t<meta property=\"og:image:height\" content=\"273\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Rick Donato\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Rick Donato\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"6 minutes\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#article\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\"},\"author\":{\"name\":\"Rick Donato\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\"},\"headline\":\"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0\",\"datePublished\":\"2013-12-01T00:00:00+00:00\",\"dateModified\":\"2023-01-15T23:01:11+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\"},\"wordCount\":928,\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png\",\"articleSection\":[\"Cisco Firewalls\"],\"inLanguage\":\"en-US\"},{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\",\"url\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\",\"name\":\"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0 - Fir3net\",\"isPartOf\":{\"@id\":\"https:\/\/www.fir3net.com\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage\"},\"thumbnailUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png\",\"datePublished\":\"2013-12-01T00:00:00+00:00\",\"dateModified\":\"2023-01-15T23:01:11+00:00\",\"description\":\"&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA\",\"breadcrumb\":{\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png\",\"width\":656,\"height\":273},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\/\/www.fir3net.com\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Security\",\"item\":\"https:\/\/www.fir3net.com\/security\"},{\"@type\":\"ListItem\",\"position\":3,\"name\":\"Firewalls\",\"item\":\"https:\/\/www.fir3net.com\/security\/firewalls\"},{\"@type\":\"ListItem\",\"position\":4,\"name\":\"Cisco Firewalls\",\"item\":\"https:\/\/www.fir3net.com\/security\/firewalls\/cisco\"},{\"@type\":\"ListItem\",\"position\":5,\"name\":\"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.fir3net.com\/#website\",\"url\":\"https:\/\/www.fir3net.com\/\",\"name\":\"Fir3net\",\"description\":\"Keeping you in the know\",\"publisher\":{\"@id\":\"https:\/\/www.fir3net.com\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.fir3net.com\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\/\/www.fir3net.com\/#organization\",\"name\":\"Fir3net\",\"url\":\"https:\/\/www.fir3net.com\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\",\"url\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"contentUrl\":\"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png\",\"width\":390,\"height\":88,\"caption\":\"Fir3net\"},\"image\":{\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037\",\"name\":\"Rick Donato\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g\",\"caption\":\"Rick Donato\"},\"description\":\"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders.\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0 - Fir3net","description":"&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html","og_locale":"en_US","og_type":"article","og_title":"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0 - Fir3net","og_description":"&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA","og_url":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html","og_site_name":"Fir3net","article_published_time":"2013-12-01T00:00:00+00:00","article_modified_time":"2023-01-15T23:01:11+00:00","og_image":[{"width":656,"height":273,"url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png","type":"image\/jpeg"}],"author":"Rick Donato","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Rick Donato","Est. reading time":"6 minutes"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#article","isPartOf":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html"},"author":{"name":"Rick Donato","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037"},"headline":"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0","datePublished":"2013-12-01T00:00:00+00:00","dateModified":"2023-01-15T23:01:11+00:00","mainEntityOfPage":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html"},"wordCount":928,"publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"image":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png","articleSection":["Cisco Firewalls"],"inLanguage":"en-US"},{"@type":"WebPage","@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html","url":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html","name":"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0 - Fir3net","isPartOf":{"@id":"https:\/\/www.fir3net.com\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage"},"image":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage"},"thumbnailUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png","datePublished":"2013-12-01T00:00:00+00:00","dateModified":"2023-01-15T23:01:11+00:00","description":"&nbsp; Purpose The purpose of this article is to explain the configuration steps required in configuring a hairpinned VPN with double NAT on a Cisco ASA","breadcrumb":{"@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#primaryimage","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/2013\/12\/images_legacy_vpndoublenat.png","width":656,"height":273},{"@type":"BreadcrumbList","@id":"https:\/\/www.fir3net.com\/Firewalls\/Cisco\/configuring-a-hairpin-vpn-with-double-nat-on-a-cisco-asa-running-80.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.fir3net.com\/"},{"@type":"ListItem","position":2,"name":"Security","item":"https:\/\/www.fir3net.com\/security"},{"@type":"ListItem","position":3,"name":"Firewalls","item":"https:\/\/www.fir3net.com\/security\/firewalls"},{"@type":"ListItem","position":4,"name":"Cisco Firewalls","item":"https:\/\/www.fir3net.com\/security\/firewalls\/cisco"},{"@type":"ListItem","position":5,"name":"Configuring Hairpin VPN with Double NAT on Cisco ASA 8.0"}]},{"@type":"WebSite","@id":"https:\/\/www.fir3net.com\/#website","url":"https:\/\/www.fir3net.com\/","name":"Fir3net","description":"Keeping you in the know","publisher":{"@id":"https:\/\/www.fir3net.com\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.fir3net.com\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.fir3net.com\/#organization","name":"Fir3net","url":"https:\/\/www.fir3net.com\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/","url":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","contentUrl":"https:\/\/www.fir3net.com\/wp-content\/uploads\/Fir3net-Background-Logo-compressed.png","width":390,"height":88,"caption":"Fir3net"},"image":{"@id":"https:\/\/www.fir3net.com\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/ab35009601b7687ee1c5310be6038037","name":"Rick Donato","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.fir3net.com\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/d75d69a54c0ca3b32c24c3a9703b623c?s=96&d=mm&r=g","caption":"Rick Donato"},"description":"Rick Donato is a Network Automation Architect\/Evangelist and the founder of Packet Coders."}]}},"_links":{"self":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/818"}],"collection":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/comments?post=818"}],"version-history":[{"count":3,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/818\/revisions"}],"predecessor-version":[{"id":3569,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/posts\/818\/revisions\/3569"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media\/817"}],"wp:attachment":[{"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/media?parent=818"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/categories?post=818"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.fir3net.com\/wp-json\/wp\/v2\/tags?post=818"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}