Site to Site VPN - ASA to PIX - Same Subnet Inside

Answered Question
Dec 6th, 2010

Chaps,

I have an unusual scenario whereby i require a site to site vpn tunnel between a version 7 cisco pix and a version 8 cisco asa which have the same ip subnet at each endpoint.  Is it possible to create such a site to site tunnel or will i need to change one of the remote endpoints?

Thanks

Nick

I have this problem too.
0 votes
Correct Answer by Federico Coto F... about 4 years 3 months ago

Hi Nicholas,

To allow the traffic to flow through the tunnel when having the same addressing scheme on both ends, you should NAT the VPN traffic.

ie.

Site A LAN 10.1.1.0/24

Site B LAN 10.1.1.0/24

Site A config:

access-list NAT permit ip 10.1.1.0 255.255.255.0 192.168.2.0 255.255.255.0

static (in,out) 192.168.1.0 access-list NAT

access-list crypto permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

Site B config:

access-list NAT permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0

static (in,out) 192.168.2.0 access-list NAT

access-list crypto permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

The idea is that Site A will be translatefd to 192.168.1.0 when going to Site B, and Site B will be translated to 192.168.2.0 when going to Site A.

Hope it makes sense.


Federico.

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 5 (1 ratings)
Correct Answer
Federico Coto F... Mon, 12/06/2010 - 07:07

Hi Nicholas,

To allow the traffic to flow through the tunnel when having the same addressing scheme on both ends, you should NAT the VPN traffic.

ie.

Site A LAN 10.1.1.0/24

Site B LAN 10.1.1.0/24

Site A config:

access-list NAT permit ip 10.1.1.0 255.255.255.0 192.168.2.0 255.255.255.0

static (in,out) 192.168.1.0 access-list NAT

access-list crypto permit ip 192.168.1.0 255.255.255.0 192.168.2.0 255.255.255.0

Site B config:

access-list NAT permit ip 10.1.1.0 255.255.255.0 192.168.1.0 255.255.255.0

static (in,out) 192.168.2.0 access-list NAT

access-list crypto permit ip 192.168.2.0 255.255.255.0 192.168.1.0 255.255.255.0

The idea is that Site A will be translatefd to 192.168.1.0 when going to Site B, and Site B will be translated to 192.168.2.0 when going to Site A.

Hope it makes sense.


Federico.

Actions

Login or Register to take actions

This Discussion

Posted December 6, 2010 at 6:31 AM
Stats:
Replies:1 Overall Rating:5
Views:3593 Votes:0
Shares:0
Tags: No tags.
 

Discussions Leaderboard

Rank Username Points
1
Federico Coto F...
1,913
2
Jouni Forss
1,876
3
Marvin Rhoads
1,595
4
Karsten Iwen
1,109
5
Jon Marshall
683
Rank Username Points
Jon Marshall
145
rizwanr74
77
Karsten Iwen
46
Marvin Rhoads
25
antondaneyko
10