[c-nsp] PIX: Source [NP]AT traffic from the other side of a tunnel. Possible?

[Matt Stockdale]

Folks -

  With the following setup 

10.4.71.0/24------(inside)PIX A(outside)---------Internet----------(outside)PIX B(inside)--172.20.0.0/26

  Is it possible to source NAT/PAT traffic from 172.20.0.0/16 to
10.4.71.0/24, such that it appears to be coming either from the inside
interface of PIX A itself, or a internal global NAT IP for this purpose?

  My attempts so far have resulted in

  %PIX-3-305005: No translation group found for icmp src outside:172.20.66.126 dst inside:10.4.71.254 (type 8, code 0)

I've set up the "outside" nat config thusly

nat (outside) 1 access-list fromClient outside

where acl fromClient is multiple entries like

  access-list fromClient permit ip host 172.20.66.116 10.4.71.0 255.255.255.0

for each host allowed over the tunnel.

sh xlate detail looks "good".. (10.4.71.252 is PIX A, configured via global (inside) 1 interface)

# sh xlate detail
1 in use, 3 most used
Flags: D - DNS, d - dump, I - identity, i - inside, n - no random,
       o - outside, r - portmap, s - static
ICMP PAT from outside:172.20.66.126/512 to inside(fromClient):10.4.71.252/1 flags ro

I'm running a tcpdump on the target host, and it's not receiving any packets.

Thoughts?


Thanks in advance

Matt