topic IPSec tunnels between duplicate LAN Subnets in Network Security

IPSec tunnels between duplicate LAN Subnets

Stephen Sisson — Tue, 12 Mar 2019 03:08:41 GMT

Hello everyone,

We need you help connecting three sites with our Central site having all the resources for the users including internet access.

All three sites will have the ASA 5505 as their WAN device.

We need to know is this possible, for configuring an IPsec Tunnel Between all three ASA's with Duplicate LAN Subnets.

Central Site two networks 192.168.1.x /24, 192.168.100.x /24

Remote One subnet 192.168.1.x /24

Remote Two one subnet 192.168.100.x /24

If above is possible we also need to do Hair pinging from Remote One, Remote Two to the Central Site for internet access, everything both sites need are located at the Central Site, including e-mail, network folders, other resource too.

We have no other way for doing this network, as all security is located at our Central Site, for Website filtering, Application filtering, all network traffic filtering.

We understand we can change both Remote sites to a different subnet from the Central Site but we have so many host devices this will take weeks or months to complete, along with changing the MS AD Domain for all end users, Servers too.

We really need your expertise for doing this in a lab then into production.

Thank you

IPSec tunnels between duplicate LAN Subnets

jumora — Fri, 22 Nov 2013 20:31:25 GMT

IF you configure NAT then yes, but I would suggest to move this ticket to the VPN queue

Value our effort and rate the assistance!

IPSec tunnels between duplicate LAN Subnets

Stephen Sisson — Fri, 22 Nov 2013 20:35:41 GMT

IPSec tunnels between duplicate LAN Subnets

jumora — Sat, 23 Nov 2013 05:28:51 GMT

You know that you can move the post to a VPN queue right???

Value our effort and rate the assistance!

Re: IPSec tunnels between duplicate LAN Subnets

Marius Gunnerud — Sat, 23 Nov 2013 20:21:15 GMT

As jumora has mention, you can do this by using NAT. Setup a different subnet for each site and NAT to that subnet. Then create a crypto ACL that specifies the local LAN as the source and the NATed subnet as the destination. This must be done at each site.

The down side to this is that if you are using FQDNs to access servers/PCs at each site, then you would need to create static DNS entries for each new NATed server IP.

Please rate all helpful posts

Re: IPSec tunnels between duplicate LAN Subnets

Marius Gunnerud — Sat, 23 Nov 2013 20:25:03 GMT

Depending on your ASA version the commands will be different, but concept is the same. Have a look at this link to get an idea on how to do it.

http://www.cisco.com/en/US/products/ps6120/products_configuration_example09186a0080b37d0b.shtml

Please rate all helpful posts

IPSec tunnels between duplicate LAN Subnets

Stephen Sisson — Mon, 25 Nov 2013 16:15:27 GMT

We are currently working on this in our lab, thank you for the documentation

Thank you all