I've been trying to jump through two tunnel. A Customer has a cloud solution which we need access to. Since we already have a vpn site2site tunnel to the customer we can already access his LAN. What we try to do now is to expand the tunnel to the cloud provider with our internal IP Subnet so the customer ASA will push traffic to the cloud provider.
Everything is set up and I expected it to work.
Something that makes this a bit harder is that we need to NAT a couple of subnets due to other customers having the same subnets already configured on our hardware.
So the config looks like this right now:
access-list outside_cryptomap_3; 5 elements; name hash: 0x4c48cff2
access-list outside_cryptomap_3 line 1 extended permit ip <CUSTOMER_LAN_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=474)
access-list outside_cryptomap_3 line 2 extended permit ip <CUSTOMER_CLOUD1_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=464)
access-list outside_cryptomap_3 line 3 extended permit ip <CUSTOMER_CLOUD2_NAT_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=463)
access-list outside_cryptomap_3 line 4 extended permit ip <CUSTOMER_CLOUD3_NAT_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=464)
access-list outside_cryptomap_3 line 5 extended permit ip <CUSTOMER_CLOUD4_NAT_SUBNET> 255.255.255.0 <OUR_SUBNET> 255.255.255.192 (hitcnt=464)
crypto map outside_map 3 match address outside_cryptomap_3
crypto map outside_map 3 set pfs group5
crypto map outside_map 3 set peer <OUR_PUBLIC_IP>
crypto map outside_map 3 set ikev1 transform-set ESP-AES-256-SHA
crypto map outside_map 3 set reverse-route
nat (inside,outside) source static NONAT_NETWORKS NONAT_NETWORKS destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp route-lookup
nat (inside,outside) source static CLOUD_DMZ CLOUD_NAT_DMZ destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp
nat (inside,outside) source static CLOUD_MGMT CLOUD_NAT_MGMT destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp
nat (outside,inside) source static Txxxxx_Remote_Network Txxxxx_Remote_Network destination static CLOUD_NAT_DMZ CLOUD_DMZ no-proxy-arp
nat (inside,outside) source static CLOUD_LST CLOUD_NAT_LST destination static Txxxxx_Remote_Network Txxxxx_Remote_Network no-proxy-arp
nat (outside,inside) source static Txxxxx_Remote_Network Txxxxx_Remote_Network destination static CLOUD_NAT_LST CLOUD_LST no-proxy-arp
nat (outside,inside) source static Txxxxx_Remote_Network Txxxxx_Remote_Network destination static CLOUD_NAT_MGMT CLOUD_MGMT no-proxy-arp
object-group network NONAT_NETWORKS
network-object <CUSTOMER_LAN_SUBNET> 255.255.255.0
network-object <CUSTOMER_CLOUD1_SUBNET> 255.255.255.0
object network Txxxxx_Remote_Network
subnet <OUR_SUBNET> 255.255.255.192
object network CLOUD_DMZ
subnet <CUSTOMER_CLOUD3_SUBNET> 255.255.255.0
object network CLOUD_NAT_DMZ
subnet <CUSTOMER_CLOUD3_NAT_SUBNET> 255.255.255.0
object network CLOUD_MGMT
subnet <CUSTOMER_CLOUD4_SUBNET> 255.255.255.0
object network CLOUD_NAT_MGMT
subnet <CUSTOMER_CLOUD4_NAT_SUBNET> 255.255.255.0
object network CLOUD_LST
subnet <CUSTOMER_CLOUD2_SUBNET> 255.255.255.0
object network CLOUD_NAT_LST
subnet <CUSTOMER_CLOUD2_NAT_SUBNET> 255.255.255.0
The issue right now is the following:
Routing failed to locate next hop for ICMP from outside:<OUR_NETWORK>/1 to inside:<cloud_mgmt_ip>/0
Can anyone help out? What am I missing?
Thanks a lot in advance :)
show route
output. Also, your question could use more details... who is the cloud provider (what is their IP space)? What is their IP space expanding to? What IP addresses are creating conflict on the other side? Which solution for a VPN with overlapping networks are you trying to implement?