topic Two Site to Site VPNs with the same external subnet. in General Topics

Two Site to Site VPNs with the same external subnet.

kdingwall — Mon, 03 Jul 2017 17:24:19 GMT

I have a Site to Site VPN to a customer and they are using 192.168.5.0/24. I have a new customer using the same subnet. I have configured this on a Cisco ASA using PAT. I am fairly new to Palo Alto firewalls and do not know how to configure this. I am using a PA-3020 running 8.0.2.

Re: Two Site to Site VPNs with the same external subnet.

BPry — Mon, 03 Jul 2017 19:07:11 GMT

@kdingwall,

The following link deals exactly with what you are experiancing 😉

https://live.paloaltonetworks.com/twzvq79624/attachments/twzvq79624/documentation_tkb/83/1/Configuring%20route%20based%20IPSec%20with%20overlapping%20networks.pdf

P.S: This doc is supper old, the basic idea is the same though and the screenshots will tell you where and what you need to edit. If you look at something and think that it doesn't look right, it's probably because it's supper out of date.

Re: Two Site to Site VPNs with the same external subnet.

VinceM — Tue, 04 Jul 2017 12:23:45 GMT

Hi all,

100% agree with BPry. this doc is very very old but always up to date and usefull.

Just keep in mind. You need to do that on the server side firewall.

Mean if you do that on your palo, your partner will be able to access your ressources but you can't access their.

If you need to access their server, you need to do the same on your partner side (if supported)

Hope help.