VPN with overlapping subnets

[nthen]

We have recently acquired 3 companies and all are using 192.168.1.0/24 as their local subnet.  Now in a perfect world I could just go on-site and and change the addresses, but as well all know it's not and they have critical services running on AS400 systems that need to remain online during the transition.  So here is where NAT comes in.  I need to establish 3 IPSec tunnels and basically say that when traffic is going to 172.16.200.x (for example) go through tunnel.200 and change the IP back to 192.168.1.x.  And...when traffic comes from 192.168.1.x through tunnel.200 change to 172.16.200.x.  I know this can be done (as I have done it on Cisco and SonicWALL), but am just drawing a blank on how to set it up on the PA.  Any thoughts?

[panos]

Configuring route based IPSec with overlapping networks

[kprakash]

Here is an old document, but the concept and the steps still holds good while building VPNs for overlapping subnets.

https://live.paloaltonetworks.com/docs/DOC-1594

You will require Static Bi directional NAT configuration in order to have a seamless flow of traffic for these over lapping subnets, via the VPN

BR,

Karthik

[nthen]

Their device only supports policy based VPNs not route based.  Would I do the same thing?

[VinceM]

Hi,

Doesn't matter. Policy or toute based VPN is important for VPN config after that, subnet overlapping will be solved by NAT.

Hope help.

V.