Reg. overlapping networks for S2S VPN

Unanswered Question
May 6th, 2008

Hi all

Iam facing an overlaping nw issue while establishing a S2S VPN tunnel .Remote end is Cisco PIX Firewall ; however that is an internal PIX Firewall (with public IP) . The remote perimeter fw is Checkpoint (next hop of PIX)

My end vpn gateway is VPN Concentrator but perimeter fw is Checkpoint fw.One of the interface of my end CP Firewall is VPN Concentrator . My end VPN Conc and CP FW are connected to L2 Switch which connects to Internet router .

There is an issue when i am trying to establish VPN TUNNEL between PIX (remote gateway) and VPN Concentrator (my end).The issue is that the remote end is having the subnet and trying to access the subnet at my end ;however is present at their end also. Please let me know as to how can i configure the NATTING at my VPN Concentrator end to translate the addresses , if i want those ppl should come with different destn IP Address to access devices at my end .

The crypto acl in the VPN Conc (my end ) includes (which is a free IP) I want that remote users with IP Range should connect to this IP ( when packet will hit the VPN Conc and should get translated to

Please help as this is urgent



I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
cisco24x7 Tue, 05/06/2008 - 11:04

On the Pix side, their network is They will be accessing

on your side that you will translate into on your side. On your side,

you will NAT the source of into when going to destination


Basically, no change on the Pix's side:

access-list nonat permit ip

access-list vpn permit ip

nat (inside) 0 access-list nonat

crypto map vpn 10 ipsec-isakmp

crypto map vpn 10 match address vpn

crypto map vpn 10 set trans 3des

crypto map vpn 10 set peer VPNC

crypto map vpn interface outside

On the concentrator, you setup NAT on concentrator for source destination You then translated the destination to and keep the source

original. It can be done with a few click on the VPNc.

Easy right?

ankurs2008 Tue, 05/06/2008 - 12:48


u have understood my issue correctly but can u tell me how to configure this at VPN Concentrator ?




This Discussion