topic IPsec tunnels to multiple peers with overlapping remote networks in General Topics

IPsec tunnels to multiple peers with overlapping remote networks

RaymondLeeDOT — Thu, 09 Jan 2025 03:37:37 GMT

Say I have site-to-site IPsec tunnels from my Palo to 2 different peers. How do I handle the case when the 2 peers have the same or overlapping networks? Do I ask one of the peers if they can NAT their network to something that doesn't conflict with my other peer? What if neither peer is able to NAT?

Re: IPsec tunnels to multiple peers with overlapping remote networks

JayGolf — Thu, 09 Jan 2025 03:58:40 GMT

Hi @RaymondLeeDOT ,

It would be easiest for you if one of the peers can handle NAT on their end and use a subnet that works for your environment. If none of the peers can handle NAT, you'll have to create 2 separate subnets for each peer and take care of the NAT for their connections.

Re: IPsec tunnels to multiple peers with overlapping remote networks

RaymondLeeDOT — Fri, 10 Jan 2025 19:39:50 GMT

Hi @JayGolf,

If I were to do the NATing on my end, can you explain why I would need 2 separate subnets? I would just need to NAT for one of the peers in order to resolve the IP overlap, right? Assuming that I'm NATing 192.168.1.0/24 to 172.16.1.0/24 for Peer X, do my static routes and NAT rules below look correct?

However, if I need to create more tunnels to other peers who also use 192.168.1.0/24 on their side, then it's going to be a NATing nightmare for me.