Multiple Tunnels with the same remote network & destination in crypto maps

[BillGlodek]

This maybe a beginner question, but I only have production systems and really dont have a way to test it our properly. We have an ASA 5520 with multiple site to site tunnels. We have one tunnel already with one of the remote networks being 10.100.90.14. We have this IP address in a subnet configured as the remote network and as the destination address in the crypto map. We also have NAT exempt rules in place for our local network with the 10.100.90.14 address as the destination.

We have another tunnel that needs to be built that will have a different peer address, but is requiring a large number of subnets and at least one will have the same remote network/destination address in the crypto map and another VPN tunnel we already have in place.

Is this possible to do with a site to site tunnel without doing a static or dymanic NAT to another IP address?

I know with the physical networks you cant do this because of the static routes that are in place, but with the ipsec tunnels I am just not sure how this will work and as mentioned I am not able to test it.

Any guidance would be appreciated.

[Jon Marshall · Accepted solution]

Bill

The crypto map acl defines the interesting traffic. If you have the same destination IP address ie. 10.100.90.14 then if the source ie. the IP address of the client on your network is the same for both tunnels then no it won't work and you will have to do some sort of NAT for one of the tunnels.

Jon

[BillGlodek]

Thats what I thought and just wanted to verify. Thanks

[BillGlodek]

Just a follow up to your answer. If our local networks are different for the tunnels, so say tunnel A has a local network of 172.21.200.0/24 and tunnel B will connect to our local network 172.21.210.0/24, both have the remote network of 10.100.90.14 then the traffic would be different and that would work? When the tunnel connects and goes through the crypto maps, it will look for an identical match for the source and destination networks so they would be different and should work correct?

With this theory, if tunnel A has the remote network defined as 10.100.90.0/24 but tunnel B has the remote network of host:10.100.90.14 then this would work with different local networks. Would this also work for the same local networks?

Thanks for your help.

[nomair_83]

For same it will not work without configuring nat for one remote subnet to X ip...and yes for different remote subnets it will work.