Hello.
I have a problem that I have a small branch with ASA-5505 using the VPN connects to two branches and headquarters, unfortunately, even though I used the crypto-map priority, in this configuration, it does not work.
I mean, first to move traffic to Lodz network with accurate mask 10.57.0.0/255.255.240.0 and then to the Head Office (Warsaw) network with the overlying network mask Lodz network 10.0.0.0/255.0.0.0
I also wanted to add that if I configure the same VPN to other networks without overlapping then this work properly, so I know that the problem is related with overlapping.
How to configure ASA when last network with big mask /8 overlapping with other networks with smaller masks /14 or /20 bits.
Please find attached diagram and configuration part.
access-list Wan1_cryptomap extended permit ip object LocalNetworkVPN object VPNRemoteLodz (10.57.0.0 255.255.240.0)
access-list Wan1_cryptomap_1 extended permit ip object LocalNetworkVPN object VPNRemoteWarszawa (10.0.0.0 255.0.0.0)
crypto ipsec security-association pmtu-aging infinite
crypto map Wan1_map 20 match address Wan1_cryptomap
crypto map Wan1_map 20 set peer 107.x.x.41
crypto map Wan1_map 20 set ikev1 transform-set ESP-3DES-SHA
crypto map Wan1_map 600 match address Wan1_cryptomap_1
crypto map Wan1_map 600 set peer 107.x.x.70
crypto map Wan1_map 600 set ikev1 transform-set ESP-3DES-SHA
crypto map Wan1_map interface Wan1
crypto map Wan1_map interface Wan2
Thank you.
*********************************
Comel - Tomasz Hinz
