Site to Site VPN

[ITSMC24]

Quick question on setting a site to site vpn, using tunnel mode. If I have a site "A" peer going and connecting with a site "B" peer for a VPN, can both sites have the same IP address subnet, or will that conflict? 

Scenario:

  Site A: 192.168.20.5/24 (Local LAN)

  Site B: 192.168.20.88/24 (Local LAN)

Would a NAT be required within the Palo Alto Firewall if I did not change one of sites subnets?

[JayGolf]

Hi @ITSMC24 ,

Yes, you will need to create a unique subnet that doesn't overlap with any of your managed subnets, make sure you point routing to those new subnets via the tunnel, and create the appropriate NAT policies. 

[BPry]

@ITSMC24,

To expand on what @JayGolf mentioned; you can either set this up as is and utilize NAT to get around the conflicting subnets, or you take the easier route and change one side. It's easiest in a lot of environments to just forgo the overlapping subnets if possible so you don't have to worry about setting specific DNS entries or the like up to direct traffic from one network to the next.

If you need to deal with the overlapping subnets, and it looks like you just need access to a single node, that would be done via NAT to remove the conflict. There used to be a good KB about this that appears to have been removed, but THIS describes the process perfectly fine with a quick search. That should help get you in the right direction.

[ITSMC24]

All,

  @JayGolf and @BPry Thank you for the insight on this subject matter. For the one side NAT, if I choose to add more remote sites in the future then would I have to create a one-site NAT to each of the remote tunnels? 

Thanks again, this was very helpful.