Connecting to our customers with VPNs

Question

The scenario: I work in a MSP that manages all the IT enviroment of 50 customers. Some customers are full managed by us (servers, network, firewall, etc). Others are partially managed (just the database server or just the web server). We access those clients in different ways, like a SSH, TS, Citrix, VPN client, etc.

What we want to do is: Connect to our customers with VPNs site-to-site (using IPSec). We have a Sonicwall firewall that can have up to 80 IPSec tunnels. By doing this, we will be able to use centralized management tools like Puppet, SCCM, logging, etc.

The problem: We have a range like 192.168.0.0/24. Other customers have this range too. Other 3-5 customers also have a 192.168.1.0/24 range.

So, the question is:

• How can we manage this VPN with overlap address? How NAT would help me with this?
• Is this a good way to work? Do you guys have similar scenarios?
• If it's not, what could we do? What you guys suggest?

Thank you very much!

Answer 1

I would start by limiting your exposure to these kinds of conflicts by using a less common RFC 1918 local network. I have rarely seen 172.24.0.0 - 172.31.0.0 used in smaller networks. Most fall in to the 192.168.0.0 range that you have listed.

For your current predicament Source NAT is really the only viable option with that configuration. You would need to Source NAT your customers overlapping network to an unused internal network. For example:

192.168.0.0/24 -> Source Nat -> 10.240.0.0/24

192.168.1.0/24 -> Source Nat -> 10.240.1.0/24

Here is an older article that walks through the configuration with a Cisco ASA.

There are other options but this is pretty standard when you only control one side of the address scheme.

Daniel

Answer 2

I agree with Daniel here. The best way to stay out of these kind of conflicts is to use a less common private ip range. I tend to use ranges from 172.16.0.0/12