DMVPN (NAT?) solution with spokes with all the same subnets

[sossie]

Hi all,

I have a large number of remote networks that are spread all over the world. Currently they are all individual island with no connectivity to anywhere else.

What I would like to do is connect them all back to head office over the internet so I can remotely access them. The internet service I get from every site will be different and unknown e.g some directly on the internet, some behind NAT.

So I think the solution to this is DMVPN.

But my problem is that all of the remote sites have the same internal subnet. So how can I make sure they are all connected and the remote devices are all accessible at the same time?

I'm wondering if I can setup NAT on perhaps the Spoke router so that every device has a static nat with the Natted IP being unique. I have labbed this up in GNS3 and it seems to work. However the problem is that there are hundreds of devices at each site, which means a lot of NAT entries.

I'm wondering is it possible to do a full 1:1 Nat just specifying an entire network to network. E.g something like 192.168.20.0/24 NAT to 10.0.1.0/24  if try to access 192.168.20.5 it actually connects to 10.0.1.5

Has anyone ever got something like this working?

Is there a good solution?

Thanks, Simon

[ghostinthenet · Accepted solution]

It's possible, but (assuming they're already using NAT for their Internet access) you're going to need to define things very carefully to avoid interfering with what they have.

Doing a full subnet translation is easy and is a one-liner:

ip nat inside source static network 10.0.0.0 192.168.0.0 /24

The problem is that this will override any existing NAT for this subnet, so you have to make it, and the existing NAT configuration conditional.

Can you provide an example of how the current NAT is set up for one of these sites?