LAN-to-LAN subnets

[ntriplett]

We are looking to impement a VPN between two offices and had a question as to the subnets used for the offices. Can the addresses for both offices be within the same subnet or must they be different subnets? What is the mechanism that governs this? Does it use arp tables for the individual addresses or is it a routing function that looks at the netmask? Or is this dependant upon the VPN used?

Your assistance is greatly appreciated.

[cjacinto]

The subnets should be of different for the two internal networks that you would want to communicate

with via the vpn tunnel. See sample config of a simple lan to lan on:

http://www.cisco.com/warp/customer/707/30.html

If however your private subnets are the same, you could basically nat one side first before it goes thru the vpn tunnel. In most cases you do the nat on

another device/router before it goes thru the vpn tunnel. Basically what governs the use of different subnet is routing, as you normally don't route to the same subnet. The router basically check the crypto acl configured in conjunction with the IPSec config, to see if the traffic going through it needs to go through the IPSec tunnel.