Cisco ASA - 2 VPN connections with overlapping range

[HubertMaier]

Hi all,

I have a problem with the following setup. We have multiple offices connected via VPN to the HQ, because two offices sharing a lot of data, we want add to the ASA 5505 firewalls a second VPN site-to-site tunnel to transport the traffic directly between the offices, without the HQ between.

Company network: 10.0.0.0/8

Office 1 network: 10.1.0.0/16

Office 2 network: 10.2.0.0/16

In every ASA is a VPN tunnel with the remote network 10.0.0.0/8 and the NAT with the destination 10.0.0.0/8 configured for the tunnel to the HQ. If I add a second VPN tunnel and the NAT with the 10.X.0.0/16 range for the direct connection, I have overlapping ranges and getting problems with the NAT.

Is it possible to configure a network object with 10.0.0.0/8 exclude 10.1.0.0/16?

Andreas

[rvarelac]

Hi StroeCres, 

I think the following document might be useful:

https://supportforums.cisco.com/document/12612201/configure-vpn-policy-nat-between-2-asa-overlapping-networks

Hope it helps

-Randy-

[HubertMaier]

Hi,

please correct me if I'm wrong, but with this configuration, if I wanna connect to the site B from site A, I use a IP from the IP range 192.168.20.0/24? In this case, the DNS servers give me the wrong IP addresses for the hostnames or I must configure every hostname in the DNS server manually.

Every IP range is unique in our company and the network structur looks like a star with the HQ in the middle and all other offices connected to the HQ. Every office have a "default route" VPN connection for the company network with 10.0.0.0/8 to the HQ. The plan is it to have a shortcut directly between the offices and I wanna have a second "route" VPN connection with 10.X.0.0/16 as destination.

Andreas

[Akshay Rastogi]

Hi Andreas,

Adding to Randy, you could go through the below docs as well to understand the outputs:

http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/112049-asa8x-vpn-olap-config-00.html

Hope it helps.

Regards,

Akshay Rastogi

Remember to rate helpful posts.