I have a number of Cisco site-to-site VPNs between using ASA and Pix devices established for my clients. This is a hosted application and I need for the entire address range on the client's network to be able to hit my site. I've encountered a situation where I have overlapping VPN subnets. Several of my clients share the same internal address space (e.g. 192.168.1.x), so I've only been able to establish a VPN to one of them. What are some workarounds for this issue? Should I look at outside NATing or some way to translate the client IPs? Any other suggestions?


Nat would be the traditional solution when the customers have overlapping IPs. Pick an unused subnet on one side and NAT it to an unused subnet on the other side. This may cause problems with some protocols.

Some information on ASA NAT here, but there are plenty of guides on the Internet. http://www.tech21century.com/access-lists-and-nat-on-cisco-asa-firewalls-some-clarifications/


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.