Cisco ASA 7.2 PPPoE Lan-to-LAN IPSEC with conditional NAT Template

This is a pretty standard config, except for the conditional NAT.  So in this case, only certain local IP addresses (host in network-object LocalHostsToNATtoVendor01) will match the VPN tunnel, and will be NATted before hitting the tunnel.

!ASA Version 7.2(4)
!
enable password ********** encrypted
passwd ********** encrypted
names
!
interface Vlan1
description LAN
nameif inside
security-level 100
ip address 10.10.10.1 255.255.255.0
!
interface Vlan2
description OUTSIDE
nameif outside
security-level 0
pppoe client vpdn group MyPPPUserName
ip address pppoe setroute
!
interface Ethernet0/0
switchport access vlan 2
!

same-security-traffic permit inter-interface
same-security-traffic permit intra-interface
!
object-group network RemoteVendor01
network-object 192.168.64.0 255.255.248.0
! 
object-group network LocalHostsToNATtoVendor01
network-object host 10.10.10.150
network-object host 10.10.10.151
network-object host 10.10.10.152
network-object host 10.10.10.153
network-object host 10.10.10.154
network-object host 10.10.10.155
network-object host 10.10.10.156
network-object host 10.10.10.157
! 
access-list outside_1_cryptomap extended permit ip 172.16.6.24 255.255.255.248 192.168.64.0 255.255.248.0
access-list inside_nat0_outbound extended permit ip 172.16.6.24 255.255.255.248 192.168.64.0 255.255.248.0
! 
access-list LocalHostsToNATtoVendor01 remark conditional NAT
access-list LocalHostsToNATtoVendor01 extended permit ip object-group LocalHostsToNATtoVendor01 object-group RemoteVendor01
!
!define two NAT pools, one pool of IPs, the other the outside interface address
global (outside) 1 172.16.6.24-172.16.6.31
global (outside) 2 interface
!don't nat some hosts
nat (inside) 0 access-list inside_nat0_outbound
!do NAT this ACL
nat (inside) 1 access-list LocalHostsToNATtoVendor01
nat (inside) 2 10.10.10.0 255.255.255.0
!
crypto ipsec transform-set ESP-AES-192-SHA esp-aes-192 esp-sha-hmac
crypto map outside_map 1 match address outside_1_cryptomap
crypto map outside_map 1 set peer 192.152.45.12
crypto map outside_map 1 set transform-set ESP-AES-192-SHA
crypto map outside_map interface outside
crypto isakmp enable outside
crypto isakmp policy 10
authentication pre-share
encryption aes-192
hash sha
group 5
lifetime 28800
!
vpdn group MyPPPUserName request dialout pppoe
vpdn group MyPPPUserName localname MyPPPUserName
vpdn group MyPPPUserName ppp authentication pap
vpdn username MyPPPUserName password *********
!
tunnel-group 192.152.45.12 type ipsec-l2l
tunnel-group 192.152.45.12 ipsec-attributes
pre-shared-key *
!
! here's an interesting feature
smtp-server 10.45.26.2
prompt hostname context

Hex to Decimal

Many thanks to Chris Bryant (CCIE #12933) for finally making the decimal to hex conversion easier to understand. Put simply, it's base-16, DUH... It seems obvious, but for some reason this simple fact just didn't sink in until 6:30 this morning.

For example, the hexidecimal number 4A simply means 4 units of 16 plus 10 units of 1, or ((4 * 16)+(10 *1)) which equals 64 + 10 which equals 74.

dynamic backup routes using Cisco's Enhanced Object Tracking

     In this example, routerA has two ethernet interfaces which both connect to service providers. Using traditional static routes with different metrics would only remove the primary route if the interface itself were to go down (i.e. "line is down,protocol is down"). If the S.P. on the primary link had a routing issue or some other problem (janitor tripped over a power cable 200 miles away), routerA needs to update its routing table even though its interface is still up. Enter starge left Cisco's object tracking.

     RouterA has a primary ethernet interface at Fa1/0/1 and a backup at Fa1/0/2. We create a policy map to force pings to a certain address (something close to your critical destinations, or the the Internet at large if there's no specific traffic you want to track) to use the primary interface (no, I don't understand why it's routed to Null 0) and when that fails, it removes the default route. The secondary floating route then takes over.

!!begin sample config
hostname routerA
ip subnet-zero
ip routing
!
ip sla 1
icmp-echo 4.2.2.2
request-data-size 1400
timeout 2000
threshold 2000
frequency 3
ip sla schedule 1 life forever start-time now
!
interface FastEthernet1/0/1
description Primary Link - .1 is the default gateway for this subnet
ip address 172.16.0.2 255.255.255.0
!
interface FastEthernet1/0/2
description Backup Link - 10.0.0.1 is the gateway for this subnet
ip address 10.0.0.2 255.255.255.0
!
ip local policy route-map MY-LOCAL-POLICY
!
access-list 101 permit icmp any host 4.2.2.2
route-map MY-LOCAL-POLICY permit 10
match ip address 101
set interface Null0
set ip next-hop 172.16.0.1
!
ip route 0.0.0.0 0.0.0.0 172.16.0.1 track 100
ip route 0.0.0.0 0.0.0.0 10.0.0.1 254
!
track 100 rtr 1 reachability
!
!! end sample config

Details on Cisco's Enhanced Object Tracking feature can be found at http://www.cisco.com/en/US/docs/ios/12_3/12_3x/12_3xe/feature/guide/dbackupx.html#wp1071672 .