NAT through multi spoke ipsec VON

[Kudetauk77]

Evening all, 

I have been asked to create 4 Ipsec site to site VPN's onto a Cisco ASA 5525 . 

1.This will involve 4 customers with overlapping addresses . 

2. They will also need to route to each other as some addresses will be my companies which will route into our network form the ASA which is directly connected , some will need to reach site to site via the ASA .

I am able to create the tunnels . I am unsure how to route between 2 or more tunnels and also how to hide the overlapping addresses with NAT . When I do NAT , what addresses should I chose ? Do they have to be ones within our network ?? I have 10 sub interfaces on the inside and am unsure which to choose when natting inside to outside 

Hope that makes sense , any help would be greatly appreciated. 

Craig

[Francesco Molino]

Hi

If you want to build vpn across 4 sites with overlapping subnets, you'll need to Nat your local and remote network over a new subnets.

Here an example:

object network LOCAL_SUBNET
subnet 192.168.1.0 255.255.255.0
object network TRANSLATED_SUBNET
subnet 192.168.10.0 255.255.255.0
object network REMOTE_TRANSATED_SUBNET
subnet 192.168.20 255.255.255.0
nat (inside,outside) source static LOCAL_SUBNET TRANSLATED_SUBNET destination
static REMOTE_TRANSLATED_SUBNET REMOTE TRANSLATED SUBNET

This has to be done on each firewall.
You see in this example that your local subnet is being translated into another subnet when trying to reach the remote subnet.
The remote subnet used is a translated subnet done by using same config on remote firewall.

Doing that way on all sites it will be simpler to allow traffic between all sites.
On your crypto acl, the source subnet will be your local natted subnet and destination will be the remote natted subnet.

To allow communication between all sites, you'll need to add all remote natted subnets allowed in your crypto acl.

On all asa, you'll need to activate traffic within the same interface:
same-security-traffic permit intra-interface

And also to configure nat exemption:

nat (outside,outside) source static REMOTE-TRANSLATED-SUB-SITE1
REMOTE-TRANSLATED-SUB-SITE1 destination static REMOTE-TRANSLATED-SUB-SITE2 REMOTE-TRANSLATED-SUB-SITE2 no-proxy-arp
route-lookup

You need to add a line like that for each remote to remote communication.

You can also use object on asa like.

Here a Cisco doc explaining all this:
https://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-firewalls/211275-Configuration-Example-of-ASA-VPN-with-Ov.html

To communicate with remote offices you'll need to use IP within the translated subnet.

[Kudetauk77]

Hi Francesco , 

Completley makes sense , one question I do have is the below correct or should it be inside,outside?

This is exempting rest of the traffic from inside to outside ?? 

nat (outside,outside) source static REMOTE-TRANSLATED-SUB-SITE1 
REMOTE-TRANSLATED-SUB-SITE1 destination static REMOTE-TRANSLATED-SUB-SITE2 REMOTE-TRANSLATED-SUB-SITE2 no-proxy-arp 

Regards

Craig 
route-lookup

[Francesco Molino · Accepted solution]

Hi

The command you showed is to have nat exemption between remote sites. Yes you'll need that command to be able to communicate between sites,