Hi,

how can I achieve it in an elegant way to nat before packets are entering the ipsecv2 vpn:

Site1:
client in Site 1 internal network: a.a.a.1/24
mtk: a.a.a.10/24, a.a.a.11/24, a.a.a.12/24 (and so on mtk should use up to 70 addresses)

Site2:
server in Site2 internal network b.b.b.1/24, b.b.b.2/24 .....

packets originating from client a.a.a.1 to dest a.a.a.10 should be redirected to b.b.b.1 with a source of a.a.a.10
packets originating from client a.a.a.1 to dest a.a.a.11 should be redirected to b.b.b.1with a soruce of a.a.a.11

packets originating from server b.b.b.1 to client a.a.a.1 shoud be masqueraded with one of the mtk source addresses, e.g. a.a.a.70

the cisco way it was like:
interface Vlan1
description LAN Interface1
ip address a.a.a.70.250 255.255.255.0
ip nat outside
ip virtual-reassembly
ip nat inside source static b.b.b.1 a.a.a.10 route-map myroutemap

any idea how to get there with a RB4011?

thx in advance,

Ralf.

nobody to help a bit?

I'm not familiar with Cisco, but based on the decription, this could be what you want: Jumps to different chains are meant to optimize things, to prevent every new connection to other addresses from having to go through all 2 * 70 rules.

And connections from b.b.b.1 to a.a.a.1 need only simple:

thx sob, will give it a try in my lab.

Ralf.

sob,
it worked (after deleting my previous raw notrack prerouting rules for vpn traffic)!!
thx a lot!

Ralf.

remark:

/ip firewall nat
add action=dst-nat chain=dstnat src-address=b.b.b.1 dst-address=a.a.a.1 to-addresses=a.a.a.70

didn't work, I've to
chain=srcnat action=masquerade src-address-list=b.b.b.b dst-address-list=(part of a.a.a.a) out-interface=B1

for translating the source-ip of b.b.b.b to my own in a.a.a.a
(and add an ftp helper)

Ralf.