Two IPSec with same subnet on their end

SebastianCounty — Tue, 27 Dec 2022 15:42:33 GMT

I can't find a How-to document or community comment on this exact issue. Some that are close. And maybe I didn't search with the right terms.

I have one customer that connects to a resource on our network. We set up an IPsec VPN between them and us. Their inside subnet is 192.168.1.0/24. I set up a static route on our 'default' router that moves all 192.168.1.0/24 traffic to 'Tunnel 4' (their tunnel).

I'm trying to add a second customer via IPsec VPN, but they have the same inside subnet. I don't have the ability to tell either of them to create a NAT rule on their ends, so I'm trying to work it all out on my end.

I've thought about creating a separate virtual router with a separate public IP and using that as the VPN endpoint for them. I just wanted to make sure that is the best way to go about this. Seems I could just create a NAT rule that translates their IP address into something else and then, I could just route traffic to/from that (something else) IP range to 'Tunnel 5' (the new tunnel).

Is this something easy that I'm just overlooking? Am I on the right track with that NAT idea? Or is the separate router the best option?

I appreciate any help and opinions given.

Kevin

Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

Re: Two IPSec with same subnet on their end

OtakarKlier — Tue, 27 Dec 2022 16:36:37 GMT

Hello,

Are the devices on the customers end Policy based? Here is an older article that may help out.

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClUFCA0

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNxCAK

Regards,

topic Re: Two IPSec with same subnet on their end in General Topics

Two IPSec with same subnet on their end

Re: Two IPSec with same subnet on their end