• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 373
  • Last Modified:

VPN between two networks with same IP ranges?

I have two networks with the same private IP range (192.168.1.0/23) behind PIX firewalls.
The PIX firewalls have IPSec VPN tunnels connecting them.
Changing the IP range is not possible (due to some political limitations).
Is it possible for these two networks to talk?

I'm imagining some sort of NAT function before the VPN tunnel (or before the PIX) to convert one network range from 192.168.1.0/23 to 192.168.2.0/23 and then changing the VPN ACLs to look for 192.168.2.0/23 on the changed side.
0
RPPreacher
Asked:
RPPreacher
  • 3
2 Solutions
 
amoldkelkarCommented:
Yes NAT should definitely resolve your problem definitely.
If any assistance required plz provide more details as in the whole network needs to be mapped thats many to 1(outgoing public ip; also use PAT in that case) or is 1 to 1 mapping required.

-AK
0
 
RPPreacherAuthor Commented:
Would I be able to do the NAT on the PIX (FOS 7.2.2) or would the NAT need to take place prior to the PIX outside interface?
0
 
amoldkelkarCommented:
I have never worked on PIX but i dont see any problem in PIX support for NAT.
You can use the following link as of now,
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a00800b6e1a.shtml

Will get back with more specific info soon..
-AK
0
 
amoldkelkarCommented:
Following link should help as well in configuring NAT on PIX,
http://www.cisco.com/en/US/products/hw/vpndevc/ps2030/products_tech_note09186a0080094aad.shtml
Looks like a very good doc.

If you are looking for a VPN tunnel NATing using PIX then following link should help you,
http://www.cisco.com/warp/public/707/ipsecnat.html

Let me know.
0
 
rsivanandanCommented:
RPPreacher,

  http://cisco.com/en/US/tech/tk583/tk372/technologies_configuration_example09186a00800949f1.shtml

Follow the link and it is about overlap between PIX and 3000 Concentrator. Just looking at One PIX's configuration would be enough for you to figure out on the other side since I know you know :-)

So basically we nat the whole network to another network range on PIX itself and terminate the tunnel on the translated address.

Cheers,
Rajesh
0

Featured Post

Concerto's Cloud Advisory Services

Want to avoid the missteps to gaining all the benefits of the cloud? Learn more about the different assessment options from our Cloud Advisory team.

  • 3
Tackle projects and never again get stuck behind a technical roadblock.
Join Now