IPsec question

[Nick.Spender]

Hello

I have many IPsec connectios on my PA. But their are 2 that both use 192.168.100.x

Now IPsec A is policy based. So I have configured the proxy ID's. All working fine. Now I have narrowed the routes down to the 2 host I require. Which are 192.168.100.32/32 and .33/32 , IPsec B is a tunnel / route based IPsec. I've added the routes in which are 192.168.100.250/32 and .251/32. Should this be a problem? Also a side note can you have 2 IPsec connections which are policy base (proxy ID's) so they have the same proxy ID's but different routes i.e like I have above

Thanks Nick 🙂

[OtakarKlier]

Hello Nick,

Sounds like you have overlapping subnets. There is a PAN solution for this. Check out the following article:

https://www.paloaltonetworks.com/documentation/10/cloud-services/globalprotect-cloud-service-gsg/gpc...

Regards,

[Nick.Spender]

But thats the question do i have overlapping subnets as the routes i have for the IPsec's are as followed

IPSec A

192.168.100.250/32

192.168.100.251/32

IPSec B

192.168.100.32/32

192.168.100.33/32

So the IP addresses are not actaully overlapping as i am refereancing them as /32's 

is this correct? 

[OtakarKlier · Accepted solution]

Hello,

Sorry I misunderstood the question. This should be OK if you have the routes setup in your virtual router the same way. The PAN would then know where to send the packets.

Regards,