topic How can we implement 2 tunnels (same source firewall, different destination firewall) with same source and destination subnet. in Network Security

How can we implement 2 tunnels (same source firewall, different destination firewall) with same source and destination subnet.

ahin.shaw — Mon, 20 Jan 2020 18:26:29 GMT

I have come across a conflict situation. And given the limitation that we cannot apply an NAT to remote environment.

Tunnel 1

Local Firewall IP : x.x.x.x

Peer Firewall IP : y.y.y.y

Local Subnet : 10.252.100.0/24

Remote Subnet : 192.168.100.0/24

Tunnel 2

Local Firewall IP : x.x.x.x

Peer Firewall IP : z.z.z.z

Local Subnet : 10.252.100.0/24

Remote Subnet : 192.168.100.0/24

Please advise how can this be solved using ASA5515 firewalls.

Re: How can we implement 2 tunnels (same source firewall, different destination firewall) with same source and destination subnet.

balaji.bandi — Mon, 20 Jan 2020 19:42:42 GMT

You have to NAT somewhere to mitigate the Same subnet in the environment.

what device remote end ?

Re: How can we implement 2 tunnels (same source firewall, different destination firewall) with same source and destination subnet.

ahin.shaw — Tue, 21 Jan 2020 14:01:47 GMT

Palo Alto

I am okay with doing NAT at our end (Cisco ASA). We cannot do NAT at remote ends.

Thank You.

Re: How can we implement 2 tunnels (same source firewall, different destination firewall) with same source and destination subnet.

balaji.bandi — Tue, 21 Jan 2020 15:21:27 GMT

yes you can mitigate with differege IP address one of the site to NAT at your end.

make sure they allow your New IP address far end ACL.

Re: How can we implement 2 tunnels (same source firewall, different destination firewall) with same source and destination subnet.

ahin.shaw — Tue, 21 Jan 2020 21:02:06 GMT

The solution is brief that I realized after Balaji's comment and looking at the packet flow of Cisco ASA.

https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/113396-asa-packet-flow-00.html

ASA performs XLATE functionality which can act as Pseudo address for destination, similarly i have to NAT my source to different address. So following this when a route for tunnel is established it knows the forward (Pseudo Address) and reverse path (NATed Source).

I don't have environment to test but definitely feel it will working knowing ASA creates policy based tunnel.

Original thought was identifying solution for such cases using PA, Checkpoint, ASA and Fortigate.