06-18-2018 12:48 PM - edited 03-12-2019 05:23 AM
Hello,
I have a Cisco ASA 5510 Version 9.1(7)9 with multiple tunnels, (2) of which have duplicate hosts. These 2 tunnels are completely separate no communication between the two. The Chicago tunnel was just added and appears to be having issues with 105.180.90.16 passing traffic.
Can I have duplicate hosts like this ? dev1 and Chicago-local share a local IP too 192.168.68.58
nat (INSIDE,OUTSIDE) source static dev1 dev1-Global destination static kansas kansas
object-group network kansas
network-object 105.180.90.16 255.255.255.255
object-group network Chicago-remote
network-object 105.180.90.16 255.255.255.255
nat (INSIDE,OUTSIDE) source static Chicago-local Chicago-local destination static Chicago-remote Chicago-remote no-proxy-arp route-lookup
06-18-2018 11:28 PM
If I understand correctly you have the same IP that you need to reach via 2 vpn tunnels.
The ASA usually selects the vpn tunnel to send traffic through based on the crypto-acl and crypto map sequence number.
If different hosts from your subnet need to use different vpn tunnels or the destination ports are different, you can simply adjust the crypto-acl.
If the same source needs to access 2 different hosts with the same IP on 2 different tunnels, you will have to have a NAT in place and modify the crypto-acl accordingly. In your case the easiest solution would be to ask Chicago to NAT the 105.180.90.16 in a different IP.
HTH
Bogdan
06-19-2018 01:31 AM
06-19-2018 02:00 AM
I am not saying the customer should change the subnet, I am saying the customer should configure a nat for traffic headed to you.
In this case I can't see how you could do a nat on your side.
06-19-2018 02:15 AM
06-19-2018 05:22 AM
Considering the client has an ASA as well, the config is pretty much similar to what you wrote:
object network My-Host
host 105.180.90.16
object network Client-Local
subnet <Client real IP range>
object network Client-Global
subnet <Client new assigned IP range>
!
nat (INSIDE,OUTSIDE) source static Client-Local Client-Global destination static My-Host My-Host
, also keep in mind that the crypto-acl needs to be modified with the NATed IPs.
06-19-2018 05:44 AM
06-19-2018 06:27 AM
Yes and the vpn peer should change the source IP in the crypto-acl.
Discover and save your favorite ideas. Come back to expert answers, step-by-step guides, recent topics, and more.
New here? Get started with these tips. How to use Community New member guide