8

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...).

For every remote LAN, I translate the network client in a single IP address; for instance:

  • Client1 192.168.1.0/24 Dynamic PAT (hide) a.b.c.1/24
  • Client2 172.16.0.0/16 Dynamic PAT (hide) a.b.c.2/24
  • Client3 172.17.4.0/26 Dynamic PAT (hide) a.b.c.3/24

Everything is working fine with the current configuration, but now I have a new client (ClientN) with the same IP addressing as Client1. I tried "ClientN 192.168.1.0/24 Dynamic PAT (hide) a.b.c.n/24", but when I did it Client1 lost the connection and I had to remove ClientN's network...

Do you have an idea to permit same remote IP addresses to use VPN?

I use ASDM to setup the ASA.

  • What ASA Version are you running? You might want to look into Cisco Twice Nat . I'm not familiar enough with Twice Nat setups to give a proper answer, but it should allow you to advertise the remote network as a different subnet at your location. – Luke Dec 17 '13 at 17:18
  • 1
    We need to know what kind of VPN appliance that Clientn is using, and hopefully a text copy of that configuration. Could you update the question? – Mike Pennington Dec 19 '13 at 9:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could provide and accept your own answer. – Ron Maupin Aug 8 '17 at 18:04
1

If your ASA supports multiple context you ca try that. This means you will virtualize your ASA. You can have some clients in a context and other in other context.

| improve this answer | |
  • You cannot use VPN with multiple contexts on an ASA. – ewwhite Feb 6 '14 at 5:47
  • 1
    Support for site-to-site tunnels in multiple context mode was added in 9.0(1). – James Sneeringer Feb 6 '14 at 15:11
-2

Bidirectional network address translation (twice nat).

You can use source nat together with destination nat.

You can find a lot of info about it, for example: http://www.youtube.com/watch?v=joiKul3SV5s

| improve this answer | |
  • 3
    Can you provide more detail to improve this answer? For instance config examples, pointers to official documents, better descriptions, etc? Telling someone you can find a lot of information about it is not sufficient, and SE prefers not to have answers that are primarily links as they are subject to link rot. – YLearn Dec 17 '13 at 21:23
  • Hello I saw the video about NAT and ASA. It is very interesting but it's not talking about VPN and I think it's missing (to me). Regards – lmperso Dec 19 '13 at 7:57
  • if you're using asa 8.3 or later : object network inside-net subnet 192.168.1.0 255.255.255.0 object network vendor_vpn_nat host 172.16.75.5 object network translated_ip host 172.27.27.27 nat (inside,outside) source dynamic inside-net translated-ip destination static vendor-vpn-nat vendor-vpn-nat – Prez Dec 19 '13 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.