IPsec tunnel with same phase 2 IP addresses

[adity]

Hi Team,

 I am stuck in one issue i would like to all please help me to resolve this issue......

I have cisco FTD 3105 model with version 7.3.1, from my firewall have configured 2 tunnels for different clients but the issue is both the clients have same Phase IP address and when I initiate the traffic from my end its getting conflict with crypto ACL.

Scenario :

Site A

Site B

Site C

172.16.1.0/24-----Site A -----Connect with site to site VPN------ Site B ----- Phase 2 IP subnet: 192.168.1.0/24

172.16.1.0/24-----Site A-----Connect with site to site VPN------ Site C------Phase 2 IP subnet: 192.168.1.0/24

[MHM Cisco World]

You need to make one site use different subnet or use NAT 

MHM

[Aref Alsouqi]

I think you can fix that by creating static identity NAT rules on FTD one for each subnet. In each NAT rule you will define a new subnet ID for each of the remote subnets, let's say site B subnet will be 192.168.10.0/24 and site C subnet will be 192.168.20.0/24. Then each NAT rule will convert the new subnets to their original, 192.168.10.0/24 to 192.168.1.0/24 and 192.168.20.0/24 to 192.168.1.0/24. The crypto ACLs would need to use the new subnet IDs in this case. Alternatively, you can NAT the remote subnets on their remote firewalls, with this option, the incoming traffic will be seen by the FTD with the NAT'ed addresses, so there is no need to apply any NAT rule on the FTD apart from the normal NAT exemption rule.

[adity]

We dont have control on Remote firewall, 172.16.1.0/24(Virtual IP address) is natted ip, remote side they will receive the traffic from this IP original IP 10.12.10.0/24

[Aref Alsouqi]

Yeah that is most likely the case but you could raise this with the remote firewalls teams asking them to NAT their subnets only for the the VPN tunnels with your business. Alternatively, you can sort this out creating NAT rules on your firewall, one would be enough but I would recommend creating two in this case.

[MHM Cisco World]

Issue in remote peer and sorry it mandatory to make one remote peer do NAT for it LAN. 

MHM