1

I have been tasked to setup a VPN tunnel with an external party's network, but I hit a bit of snag.

I am currently running a Cisco ASA 5510 with private subnets of 10.1.2.0/24 on the "inside" network.

The other site I wish to connect to has a private subnet of 10.0.0.0/8.

As a result, there is a conflict on both private subnets, and I need to perform OUTSIDE NAT to NAT my ongoing host traffic of 10.1.2.0/24 to 192.168.1.0/24 (the other party has insisted I used this subnet).

The other party does not wish to make changes on their end, so everything has to be done on my firewall.

I have looked at some resources online:

http://www.packetu.com/2013/12/09/source-destination-nat-ios-vpn/
http://www.packetu.com/2012/01/02/asa-vpn-with-address-overlap/

It seems easy to effect this from configuration, however, I am already running several VPN tunnels at the moment for this network, and I am concerned the change to outbound NAT might affect my other tunnels or configurations.

For instance, I already have other remote sites of with subnets of 192.168.1.X, 192.168.2.X, etc.

  1. How do I ensure that the outbound NAT will have no effect on my existing tunnels?
  2. Would having an outbound NAT with same subnet as one of my existing remote sites cause an issue?
  3. Can I 'tailor' a specific NAT behavior just for a particular VPN Tunnel (just for this specific other party), and will this resolve any potential conflict?
  4. I also have a specific set of ACLs that deal with the same subnet of the outbound NAT of 192.168.1.X. Will there be issues?
  • 1
    You are probably looking for "twice NAT" function. What version are you running on the ASA? – Ron Trunk Mar 18 '16 at 11:34
  • Make your supervisor/management aware that the other party has designed their network idiotically (use more "political" phrasing if you like). When I have come across things like this myself, there have always been additional problems caused by this party in the future. This shows an enormous lack of knowledge and/or proper planning on their part If they are expecting to connect to other networks, and these issues will not be isolated. – YLearn Mar 18 '16 at 15:44
  • @RonTrunk, i am currently using 8.0(2) and Device manager Version 6.0(2) The twice nat function looks closer to what i should actually be doing. looks like this is going to be a greater pain to fix than what i originally thought sigh. Who blocks an entire 10.X.X.X subnet these days? – jaglin84 Mar 22 '16 at 3:15
  • I just checked, unfortunately, on my current OS i don't think i will be able to use the twice nat function, what other options do you think i can explore given the limitations? – jaglin84 Mar 22 '16 at 3:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.