4

I have a question about routed traffic across a site to site VPN between 2 Cisco ASA 5510's. We have our office side and our DR side and the question is could I have an IP conflict of gateway IP address' if I make changes on my DR side's ASA. Below is a description of our set up.

We rent a cabinet offsite for DR purposes. We have a Cisco ASA 5510 at this DR site, 5510 at the main site too, and a site to site VPN set up between them. The subnet at the DR site is the same as our server subnet (to make life easy if we need to bring up servers for an emergency) but the gateway address is different at DR than the main site. When sending any traffic between sites, we have to reach over certain subnets created in the site to site VPN and they are routable between.

So from the office to get to DR site's 10 subnet (server subnet), the site to site VPN translates: 192.168.10.0/24 to 192.168.53.0/24

From DR to the office, it translates 192.168.10.0/24 to 192.168.52.0/24.

So if you're at DR and you need to see something back at the office, you reach out to 192.168.52.1 for a server for example. From the office to get to one of our VM hosts' that are storing shut down servers at DR, 192.168.53.25. This all routes fine and it's working for us.

What I'd like to do, and I believe I should be ok to change it since all traffic between sites has to translate to those other subnets is change that 192.168.10.8 gateway address at DR (inside interface IP on my DR ASA) to 192.168.10.10 like the gateway address I have at the office. Several reasons I'd want to do so but since I'm already a pretty wordy typer, I won't bore with more details. Let's just say it will make it a heck of a lot easier in case of an emergency but I don't want to shut one site down or the other if making this change is a bad thing.

Does someone have experience with this and would I be ok?

  • I changed the int IP on sunday morning and all went without a hitch. When I get back to the site, I'll be putting it in to permanent production when I can change the gateways on all the local servers. Thanks for the advice. Be well. – Brett Polakowski Jun 10 '13 at 16:45
1

from the sounds of it, you should be able to do it without much of an issue. This is simply because of the NATing that you have going on.

A bit of a warning, if the servers are all have static IPs and default gateways, changing the IP of the firewall (current gateway), may make it harder to reach the servers, as they won't know how to get to 192.168.53.0/24 without the default gateway.

One way to mitigate this, is to create a static route on one server that points to 192.168.10.10 for traffic going to 192.168.53.0/24.

Another way would be to create a new NAT rule on the ASA for an individual host on the main site. Then on the ASA at the DR site, NAT this again to be on the same subnet as the servers.

Say, host 192.168.10.50 is NAT'd to 192.168.54.254, then pushed over the VPN. The DR ASA then NATs this again to change the source to 192.168.10.254. When the servers at the DR see this source IP, they'll know how to respond since it's in the same subnet.

  • I'm going to try to swap over the gateway whenever the boss says it's ok (a sunday morning maintenance window probably). I'll keep this NAT'ing in mind as it might be easier for me to handle in my gear than to make route changes on each server that might be affected. I'll post back here what I run in to. Thanks! – Brett Polakowski Jun 6 '13 at 15:32
  • you can configure the NAT rules now, so that you are sure it works before you do your maintenance. – emynd Jun 6 '13 at 19:53
0

I think it makes a lot of sense to make the change so that everything at both locations is the same. Because both sites are hiding behind NAT there shouldn't be a conflict. Are you using static routing between the two locations?

  • Rather than post a partial answer, it's better to ask any questions of the OP as comments under their original Q. – Craig Constantine Jun 6 '13 at 15:08
  • At our main site we have static routes on that 6509 to point traffic destined for DR to route to 53.0/24. So from main site if I want to see a backup file server I have over there, DFS replication sends the traffic to 192.168.53.1 and it connects just fine and files replicate. That's kinda why I was thinking this wouldn't be an issue. With the gateway over there now @ 10.8, bringing things up in a DR scenario causes a lot of problems if we can't get to that site physically. If a disaster happens and I've change it over to 10.10 already, I can then VPN in to that site and all will work I hope.. – Brett Polakowski Jun 6 '13 at 15:29

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.