Overlapping Subnets Site-to-Site VPN

[Jesus Crespo]

Hello Everybody,

I have few ASA's with Site to Site tunnels to 1 Hub Site.

All the sites are passing through the tunnel all the traffic to the Hub ASA. (0.0.0.0/0)

Internet access is provided via the Hub ASA.

Now i need to create site to site VPN from each location to another Hub ASA to destination 10.10.0.0/16.

When creating the tunnel i get the error of overlapping subnets via the previous tunnel (0.0.0.0/0).

How can i possibly have the 2 tunnels?

Tunnel A - Interesting traffic - 0.0.0.0/0

Tunnel B - Interesting traffic - 10.10.0.0/16

Thanks in advance!!!

[Jouni Forss · Accepted solution]

Hi,

I am not 100% sure about this as I havent had tested or had to do similiar setup before.

But you could try couple of things

• Add an ACL statement to the TOP of existing L2L VPN as a Deny statement. The ASA will give a error/warning message after this.
  • access-list deny ip 10.10.0.0 255.255.0.0

• Configure the more specific on higher order number in the "crypto map" configurations and see if that helps
  • crypto map 10 set peer
  • crypto map 1 set peer

You can naturally use "packet-tracer" and other diagnostic commands to confirm that the current L2L VPN ignores the destination network 10.10.0.0/16

Hope this helps

- Jouni

[Jesus Crespo]

Thanks for yor quick reply. I will give it a try.

[Jouni Forss]

Hi,

Think I need to clarfiy what I said in the second point.

The number after the Crypto Map name should be smaller for the new L2L VPN connection. The smaller the number, the higher the priority of the VPN connection when traffic is matched againts the crypto maps.

So in the above the configuration with  the "1" is higher priority than the one with "10"

- Jouni

[Jouni Forss]

Hi,

Did you have time to test this and get it working?

- Jouni

[Jesus Crespo]

Yes, I did and it worked pretty well.

Thanks a lot!