cisco asa 5510 - remote vpn network conflicts with inside interface

[stevegoc100]

dear all,

Can anyone help me solve this issue, we have an IPSec site to site vpn setup between our Cisco ASA 5510 and the clients vpn device:

192.168.155.0/24 and 192.168.217.0/24 and 2nd network 192.168.218.0/24

This is fine however the client's 2nd of network 192.168.218.0/24 is on the same network range as one our other inside interfaces and the traffic is going to the other inside interface instead of down the VPN tunnel.

Is their a static route I can add to push the traffic down the VPN tunnel and not towards my other inside interface?

Unfortunately manually changing either IP range is not an option.

The Cisco asa version is: 9.1(7)13 with asdm: 7.7(1)

thanks in advane

steve.

[Marvin Rhoads]

My friend Pete Long just recently posted a blog covering this sort of situation.

I recommend you have a look at it and see if it answers your question:

https://www.petenetlive.com/KB/Article/0001446

[stevegoc100]

Hi Marvin,

Thanks for the reply but what I forgot to mention is that I don't have control of the other side of the VPN! So unfortunately I cannot use the method in the blog.

Do you know if a static route can be created to send traffic to the VPN instead of the other inside interface?

thanks again

steve.

[Dennis Mink]

you will need to apply NAT to hide those overlapping subnets. so in your case the 192.168.218.0/24 subnet needs to be Natted from a unique subnet (really can be anything you chose in the private space, for instance 172.16.20.0/24. so once traffic for the 172.16.20.0/24 hits your firewall, you NAT it to 192.168.218.0/24  and send it down the VPN tunnel.  Namaste

[stevegoc100]

do you think this needs to be done at both ends of the VPN?

[Dennis Mink]

No. only on the side where there is an overlap.