I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...).

For every remote LAN, I translate the network client in a single IP address; for instance:

  • Client1 Dynamic PAT (hide) a.b.c.1/24
  • Client2 Dynamic PAT (hide) a.b.c.2/24
  • Client3 Dynamic PAT (hide) a.b.c.3/24

Everything is working fine with the current configuration, but now I have a new client (ClientN) with the same IP addressing as Client1. I tried "ClientN Dynamic PAT (hide) a.b.c.n/24", but when I did it Client1 lost the connection and I had to remove ClientN's network...

Do you have an idea to permit same remote IP addresses to use VPN?

I use ASDM to setup the ASA.

  • What ASA Version are you running? You might want to look into Cisco Twice Nat . I'm not familiar enough with Twice Nat setups to give a proper answer, but it should allow you to advertise the remote network as a different subnet at your location.
    – Luke
    Dec 17, 2013 at 17:18
  • 1
    We need to know what kind of VPN appliance that Clientn is using, and hopefully a text copy of that configuration. Could you update the question? Dec 19, 2013 at 9:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin
    Jan 3, 2021 at 20:04

2 Answers 2


If your ASA supports multiple context you ca try that. This means you will virtualize your ASA. You can have some clients in a context and other in other context.

  • You cannot use VPN with multiple contexts on an ASA.
    – ewwhite
    Feb 6, 2014 at 5:47
  • 1
    Support for site-to-site tunnels in multiple context mode was added in 9.0(1). Feb 6, 2014 at 15:11

Bidirectional network address translation (twice nat).

You can use source nat together with destination nat.

You can find a lot of info about it, for example: http://www.youtube.com/watch?v=joiKul3SV5s

  • 3
    Can you provide more detail to improve this answer? For instance config examples, pointers to official documents, better descriptions, etc? Telling someone you can find a lot of information about it is not sufficient, and SE prefers not to have answers that are primarily links as they are subject to link rot.
    – YLearn
    Dec 17, 2013 at 21:23
  • Hello I saw the video about NAT and ASA. It is very interesting but it's not talking about VPN and I think it's missing (to me). Regards
    – lmperso
    Dec 19, 2013 at 7:57
  • if you're using asa 8.3 or later : object network inside-net subnet object network vendor_vpn_nat host object network translated_ip host nat (inside,outside) source dynamic inside-net translated-ip destination static vendor-vpn-nat vendor-vpn-nat
    – Prez
    Dec 19, 2013 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.