asked on 1/28/2016

Cisco ASA - IPSec to multiple peers all with the same private subnet

I have a requirement to connect a central ASA 55xx to multiple remote sites over IPSec tunnels.

Each remote site has the same private IP subnet.

All of the documentation that I can find on VPN address overlap assumes that the local and remote peers have the same subnet, rather than multiple remote peers having the same subnet.

Can I configure the local ASA to support this ?

Cisco Internet Protocol Security VPN

Last Comment

asavener

2/1/2016

asavener

1/28/2016

Are you able to modify or influence the configuration of the endpoints? The easiest way to accomplish this is to NAT the connections at the remote endpoints. NAT takes place before crypto, so it's possible to NAT and then send the NAT'd traffic over the VPN.

Unfortunately, I can't think of a way to do source NAT'ing at the hub, and be able to differentiate the traffic.

Benjamin Van Ditmars

1/28/2016

If all the remote networks are te same you can nat the remote network to a unique network inside youre ASA. else the ASA is not able to route the traffic back to the correct tunnel interface.

use this cisco document to setup. youre configurations.

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112049-asa8x-vpn-olap-config-00.html

asavener

1/28/2016

I think that's the exact document that ccfcfc was talking about.

ccfcfc

1/29/2016

ASKER

Benjamin - as asavener said, that's the sample config that you always find when looking at dealing with overlapping networks. It's always assumed that the overlap is between the local and remote peers rather than being between multiple remote peers.

Thanks.

ASKER CERTIFIED SOLUTION

asavener

1/29/2016

THIS SOLUTION IS ONLY AVAILABLE TO MEMBERS.

View this solution by signing up for a free trial.

Members can start a 7-Day free trial and enjoy unlimited access to the platform.

See Pricing Options

Start Free Trial

ccfcfc

2/1/2016

ASKER

As an option, would Twice NAT help in this scenario or does Twice NAT have the same problem in that it still can't differentiate traffic between each VPN tunnel as they will all still have the same source and destination subnets ?

We have ASA 8.2 at the moment so don't have this option right now and it's therefore not a configuration that I have used, so I'm not familiar with how it works. If it would resolve this issue then it would help me to push for an OS upgrade.

asavener

2/1/2016

I don't think that will help.