I have a number of Cisco site-to-site VPNs between using ASA and Pix devices established for my clients. This is a hosted application and I need for the entire address range on the client's network to be able to hit my site. I've encountered a situation where I have overlapping VPN subnets. Several of my clients share the same internal address space (e.g. 192.168.1.x), so I've only been able to establish a VPN to one of them. What are some workarounds for this issue? Should I look at outside NATing or some way to translate the client IPs? Any other suggestions?
2
-
Any other suggestions? I can't seem to find a good example of this working.– ewwhiteMar 8, 2010 at 0:58
-
Possible solution: serverfault.com/questions/548888/…– ErikENov 23, 2013 at 22:43
Add a comment
|
1 Answer
Nat would be the traditional solution when the customers have overlapping IPs. Pick an unused subnet on one side and NAT it to an unused subnet on the other side. This may cause problems with some protocols.
Some information on ASA NAT here, but there are plenty of guides on the Internet. http://www.tech21century.com/access-lists-and-nat-on-cisco-asa-firewalls-some-clarifications/
Mark
