topic Re: Site to Site VPN in General Topics

Site to Site VPN

D.Callahan — Tue, 07 Jan 2025 21:07:34 GMT

Quick question on setting a site to site vpn, using tunnel mode. If I have a site "A" peer going and connecting with a site "B" peer for a VPN, can both sites have the same IP address subnet, or will that conflict?

Scenario:

Site A: 192.168.20.5/24 (Local LAN)

Site B: 192.168.20.88/24 (Local LAN)

Would a NAT be required within the Palo Alto Firewall if I did not change one of sites subnets?

Re: Site to Site VPN

JayGolf — Tue, 07 Jan 2025 21:49:18 GMT

Hi @D.Callahan ,

Yes, you will need to create a unique subnet that doesn't overlap with any of your managed subnets, make sure you point routing to those new subnets via the tunnel, and create the appropriate NAT policies.

Re: Site to Site VPN

BPry — Tue, 07 Jan 2025 22:53:02 GMT

@D.Callahan,

To expand on what @JayGolf mentioned; you can either set this up as is and utilize NAT to get around the conflicting subnets, or you take the easier route and change one side. It's easiest in a lot of environments to just forgo the overlapping subnets if possible so you don't have to worry about setting specific DNS entries or the like up to direct traffic from one network to the next.

If you need to deal with the overlapping subnets, and it looks like you just need access to a single node, that would be done via NAT to remove the conflict. There used to be a good KB about this that appears to have been removed, but THIS describes the process perfectly fine with a quick search. That should help get you in the right direction.

Re: Site to Site VPN

D.Callahan — Wed, 08 Jan 2025 14:21:19 GMT

All,

@JayGolf and @BPry Thank you for the insight on this subject matter. For the one side NAT, if I choose to add more remote sites in the future then would I have to create a one-site NAT to each of the remote tunnels?

Thanks again, this was very helpful.

Re: Site to Site VPN

JayGolf — Thu, 09 Jan 2025 17:39:27 GMT

Hi @D.Callahan ,

No prob! As far as adding additional remote sites in the future, I would recommend to ensure CIDRs are free to use and not overlapping. This way you don't have to rely on setting up NAT and you can perform full routing. I would definitely reserve some space within your network for remote sites.

Re: Site to Site VPN

D.Callahan — Thu, 09 Jan 2025 21:07:19 GMT

Sounds good, thanks JayGolf.