×

Warning message

  • Cisco Support Forums is in Read Only mode while the site is being migrated.
  • Cisco Support Forums is in Read Only mode while the site is being migrated.

Configuring an IPSec Tunnel Between Router and PIX w/Duplicate LAN Subnets

Unanswered Question
Feb 8th, 2006
User Badges:

As in title,


I need to make a site to site vpn between an pix and a router with duplicated subnets.


Pix as inside have a 192.168.144.0/24 and he manages already 2 site-to-site vpn, one with another pix (that have inside 10.10.9.0/24) and the second one with another pix (that have inside 10.10.12.0/24). Now i need to add another one vpn site to site with cisco ios (that have "inside" 10.10.9.0/24).


Any sugestion, egsample or link?


Thanks

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Loading.
mheusinger Wed, 02/08/2006 - 06:01
User Badges:
  • Green, 3000 points or more

Hello,


what you need to do is to perform NAT before the IPSec tunnel and translate the second 10.10.9.0/24 to some other network not yet used on the PIX, f.e. 10.10.99.0/24. The NAT configuration on the router would look like this:


crypto isakmp policy 10

hash md5

authentication pre-share

group 2

lifetime 300

!

crypto isakmp key MyKey address 2.2.2.2

!

crypto ipsec transform-set myset esp-des esp-md5-hmac

!

crypto map mymap local-address Serial0/0

crypto map mymap 10 ipsec-isakmp

set peer 2.2.2.2

set security-association lifetime seconds 180

set transform-set myset

match address 110

!

!

interface Ethernet0/0

ip address 10.10.9.1 255.255.255.0

ip nat inside

!

interface Serial0/0

ip address 1.1.1.1 255.255.255.252

crypto map mymap

ip nat outside

!

ip nat pool NATforTunnel 10.10.99.1 10.10.99.254 netmask 255.255.255.0

ip nat inside source list 110 pool NATforTunnel

!

access-list 110 remark NAT-list

access-list 110 permit ip 10.10.99.0 0.0.0.255 192.168.144.0 0.0.0.255


Extend the ACL 110 to your needs and adjust the IPSec stuff and IP addresses to your environment.


Hope this helps! Please rate all posts.


Regards, Martin


UNIKAPERUGIA Wed, 02/08/2006 - 07:33
User Badges:

Perfect, can you make me an eesample on the pix side?


Thanks ;)

Ranbeckycr_2 Tue, 05/24/2011 - 08:46
User Badges:

mheusinger


Thanks for this post, quick question, this example is to configure the router on my location, NOT the remote location right?

Actions

This Discussion