IPSEC VPN Connections with overlapping remote site addresses

Unanswered Question
Jan 6th, 2009

We have an ASA at our head office which terminates the IPSEC VPN connections from our ADSL connected remote offices.

We have the situation where some of our head office users require access to systems on a 3rd party site. We would like to simply set up an IPSEC VPN connection to this 3rd party site in a similar way as we do with our own remote offices.

The problem is, the internal private addressing used by the 3rd party overlaps with the private addressing used at some of our remote sites.

e.g. we have something like this:

Head Office subnet - 192.168.x.x

Remote Office 1 - 10.1.x.x

Remote Office 2 - 10.2.x.x

Remote Office 3 - 10.3..x.x

3rd Party Office - 10.x.x.x

It would only be the head office that would require connectivity with the 3rd party office. However, the head office also requires access to our similarly addressed remote offices. Is there any way we can achieve this connectivity without having to re-address the sites and without disrupting connectivity to the remote offices?

Any suggestions?

I have this problem too.
0 votes
  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 3 (2 ratings)
mitchen Tue, 01/06/2009 - 08:43

Andrew - thanks, could you expand on your suggestion some more?

Naman - thanks, I'm not sure exactly how to apply that to this particular situation though? (As the head office subnet doesn't actually overlap with the 3rd party subnet but its some of our remote sites that do - I don't want to disrupt connectivity from head office to the remote sites though)

Ahhh I re-read your post and mu suggestion was for something different, but it still kinda holds true.

You could do a policy based NAT on the remote 3rd party into your network, but I would think a static 1 to 1 should do the trick.

But I would try seomthing like:-

static (outside,inside) x.x.x.x y.y.y.y netmask z.z.z.z

x.x.x.x = NAT address you would like that does NOT conflict on your network, like

y.y.y.y = real 3rd party IP address, like

z.z.z.z = network subnet mask, like a specific host

so the above would read:-

static (outside,inside) netmask

If the remote 3rd party has multiple addresses you could do multiple static NAT statements or NAT the whole network range.

Then onces you have NATT'd the remote end - your VPN acl would just use a desintation IP address of the NATT'd IP not the real IP.


kylerossd Tue, 01/06/2009 - 14:45

You will need to double nat to get return traffic to your remote sites.


This Discussion