1

I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What we try to do now is to expand the tunnel to the cloud provider with our internal IP Subnet so the customer ASA will push traffic to the cloud provider.

Everything is set up and I expected it to work.

Something that makes this a bit harder is that we need to NAT a couple of subnets due to other customers having the same subnets already configured on our hardware.

So the config looks like this right now:

access-list outside_cryptomap_3; 5 elements; name hash: 0x4c48cff2
access-list outside_cryptomap_3 line 1 extended permit ip <CUSTOMER_LAN_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=474) 
access-list outside_cryptomap_3 line 2 extended permit ip <CUSTOMER_CLOUD1_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=464) 
access-list outside_cryptomap_3 line 3 extended permit ip <CUSTOMER_CLOUD2_NAT_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=463)
access-list outside_cryptomap_3 line 4 extended permit ip <CUSTOMER_CLOUD3_NAT_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=464) 
access-list outside_cryptomap_3 line 5 extended permit ip <CUSTOMER_CLOUD4_NAT_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=464)

crypto map outside_map 3 match address outside_cryptomap_3
crypto map outside_map 3 set pfs group5
crypto map outside_map 3 set peer <OUR_PUBLIC_IP>
crypto map outside_map 3 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 3 set reverse-route

nat (inside,outside) source static NONAT_NETWORKS NONAT_NETWORKS destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp route-lookup
nat (inside,outside) source static CLOUD_DMZ CLOUD_NAT_DMZ destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp
nat (inside,outside) source static CLOUD_MGMT CLOUD_NAT_MGMT destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp
nat (outside,inside) source static Txxxxx_Remote_Network Txxxxx_Remote_Network destination static CLOUD_NAT_DMZ CLOUD_DMZ no-proxy-arp
nat (inside,outside) source static CLOUD_LST CLOUD_NAT_LST destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp
nat (outside,inside) source static Txxxxx_Remote_Network Txxxxx_Remote_Network destination static CLOUD_NAT_LST CLOUD_LST no-proxy-arp
nat (outside,inside) source static Txxxxx_Remote_Network Txxxxx_Remote_Network destination static CLOUD_NAT_MGMT CLOUD_MGMT no-proxy-arp

object-group network NONAT_NETWORKS
 network-object <CUSTOMER_LAN_SUBNET> 255.255.255.0
 network-object <CUSTOMER_CLOUD1_SUBNET> 255.255.255.0

object network Txxxxx_Remote_Network
 subnet <OUR_SUBNET> 255.255.255.192

object network CLOUD_DMZ
 subnet <CUSTOMER_CLOUD3_SUBNET> 255.255.255.0

object network CLOUD_NAT_DMZ
 subnet <CUSTOMER_CLOUD3_NAT_SUBNET> 255.255.255.0

object network CLOUD_MGMT
 subnet <CUSTOMER_CLOUD4_SUBNET> 255.255.255.0

object network CLOUD_NAT_MGMT
 subnet <CUSTOMER_CLOUD4_NAT_SUBNET> 255.255.255.0

object network CLOUD_LST
 subnet <CUSTOMER_CLOUD2_SUBNET> 255.255.255.0

object network CLOUD_NAT_LST
 subnet <CUSTOMER_CLOUD2_NAT_SUBNET> 255.255.255.0

The issue right now is the following:

 Routing failed to locate next hop for ICMP from outside:<OUR_NETWORK>/1 to inside:<cloud_mgmt_ip>/0

Can anyone help out? What am I missing?

Thanks a lot in advance :)

  • You're 2nd and 4th NAT line seem redundant. You also provided a log message that implies routing is the issue, while not providing your show route output. Also, your question could use more details... who is the cloud provider (what is their IP space)? What is their IP space expanding to? What IP addresses are creating conflict on the other side? Which solution for a VPN with overlapping networks are you trying to implement? – Eddie Jun 18 '18 at 16:14
2

I’m stupid. So as @Eddie has pointed out it is a routing issue. The route which is the issue is of course a route to the cloud subnet which is not inside but outside through a second tunnel. Thus the nat statements should be nat (outside,outside)

Case closed.

Sorry for the lack of I formation. I tried to anonymize the data. Using dummy data would have been smarter.

Lessons learned. Don’t work 10h straight, people.

  • You should accept your answer so that the question doesn't keep popping up forever, looking for an answer. – Ron Maupin Sep 17 '18 at 21:38

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.