8

I have a ASA5510 to connect clients to my company. I use a site-to-site IPSec VPN with a variety of vendors on the other side (Cisco, Sonicwall, Zyxel, Checkpoint, etc...).

For every remote LAN, I translate the network client in a single IP address; for instance:

  • Client1 192.168.1.0/24 Dynamic PAT (hide) a.b.c.1/24
  • Client2 172.16.0.0/16 Dynamic PAT (hide) a.b.c.2/24
  • Client3 172.17.4.0/26 Dynamic PAT (hide) a.b.c.3/24

Everything is working fine with the current configuration, but now I have a new client (ClientN) with the same IP addressing as Client1. I tried "ClientN 192.168.1.0/24 Dynamic PAT (hide) a.b.c.n/24", but when I did it Client1 lost the connection and I had to remove ClientN's network...

Do you have an idea to permit same remote IP addresses to use VPN?

I use ASDM to setup the ASA.

Improve this question
3
  • What ASA Version are you running? You might want to look into Cisco Twice Nat . I'm not familiar enough with Twice Nat setups to give a proper answer, but it should allow you to advertise the remote network as a different subnet at your location.
    – Luke
    Commented Dec 17, 2013 at 17:18
  • 1
    We need to know what kind of VPN appliance that Clientn is using, and hopefully a text copy of that configuration. Could you update the question?
    – Mike Pennington
    Commented Dec 19, 2013 at 9:42
  • Did any answer help you? if so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you could post and accept your own answer.
    – Ron Maupin ♦
    Commented Jan 3, 2021 at 20:04

2 Answers 2

Reset to default
1

If your ASA supports multiple context you ca try that. This means you will virtualize your ASA. You can have some clients in a context and other in other context.

Improve this answer
2
  • You cannot use VPN with multiple contexts on an ASA.
    – ewwhite
    Commented Feb 6, 2014 at 5:47
  • 1
    Support for site-to-site tunnels in multiple context mode was added in 9.0(1).
    – James Sneeringer
    Commented Feb 6, 2014 at 15:11
-2

Bidirectional network address translation (twice nat).

You can use source nat together with destination nat.

You can find a lot of info about it, for example: http://www.youtube.com/watch?v=joiKul3SV5s

Improve this answer
3
  • 3
    Can you provide more detail to improve this answer? For instance config examples, pointers to official documents, better descriptions, etc? Telling someone you can find a lot of information about it is not sufficient, and SE prefers not to have answers that are primarily links as they are subject to link rot.
    – YLearn
    Commented Dec 17, 2013 at 21:23
  • Hello I saw the video about NAT and ASA. It is very interesting but it's not talking about VPN and I think it's missing (to me). Regards
    – lmperso
    Commented Dec 19, 2013 at 7:57
  • if you're using asa 8.3 or later : object network inside-net subnet 192.168.1.0 255.255.255.0 object network vendor_vpn_nat host 172.16.75.5 object network translated_ip host 172.27.27.27 nat (inside,outside) source dynamic inside-net translated-ip destination static vendor-vpn-nat vendor-vpn-nat
    – Prez
    Commented Dec 19, 2013 at 11:13

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.