topic Re: need to configure IP-SEC VPN between 2 sites with overlapping networks problem in General Topics

need to configure IP-SEC VPN between 2 sites with overlapping networks problem

Netsul — Fri, 14 Mar 2014 13:36:52 GMT

scenario

Site A

Any equipment IPSec firewall
internal interface: 172.16.0.1 255.255.0.0
external Interface:20.1.1.10
Internal Network: 172.0.0.0/8

VPN proxy ID

Local: 172.16.0.0/16
Remote: 192.168.98.5/32

Site B

Equipment PA-2050
internal interface: 172.22.6.245
external Interface: 20.1.1.20
Internal Network: 172.0.0.0/8

VPN proxy IP

Local: 172.22.0.0/16
Remote: 192.168.98.5

A host 172.16.0.x in Site A needs access server (172.22.6.244) in Site B by IPSec VPN Tunnel

Problem 1: The internal networks in Site A has a Vlan with 172.22.0.0/8
Problem 2: The internal networks in Site B has a Vlan with 172.16.0.0/24

How it works today with Cisco ASA:

- The host in site A initiates connection to the IP 192.168.98.5
- The PA-2050 perfoms dynamic NAT with source 172.16.0.0/24 para o IP 192.168.98.5
- O PA-2050 perfoms a static NAT with source 172.22.6.244 para 192.168.98.5

NAT ASA

NAT PA

Topology

My problem is that NAT not return this worked Static NAT not working properly in this Paloalto!!!!!!!!

Re: need to configure IP-SEC VPN between 2 sites with overlapping networks problem

HULK — Fri, 14 Mar 2014 16:20:17 GMT

Hello Netsul,

Could you please follow the doc Configuring route based IPSec with overlapping networks for the same. Specially the NAT part of the PAN firewall.

Thanks

Re: need to configure IP-SEC VPN between 2 sites with overlapping networks problem

Netsul — Fri, 14 Mar 2014 16:52:45 GMT

Hulk verificaquei the document did not work over NAT return

Re: need to configure IP-SEC VPN between 2 sites with overlapping networks problem

hyadavalli — Tue, 18 Mar 2014 04:02:24 GMT

Hello Sir,

Your NAT policies should like below:

Make sure that routing for 192.168.98.5/32 and 172.16.0.0/16 points to tunnel interface.

Assuming Out destination zone points to Tunnel interface.

Your security policies should like below:

Regards,

Hari Yadavalli