RA VPN to Hub and Spoke with Overlapping Spoke Addresses

[Cory Anderson]

Hi All,

I have a scenario where a customer has security stack in AWS in a centralized VPC.  They're trying to use a single ASA to protect multiple VPCs that have duplicate IP Addresses. They need to use site-to-site VPNs from the perimeter (hub) VPC to the spokes using a CSR to the AWS VPN service.  The spokes never talk to each other, but all VPCs will need to be able to communicate with the internet.  Remote access clients need to be able talk to each VPC, with specific tunnel groups assigned to VPCs.

How would you guys recommend accomplishing this?  VRF's with NAT/route leaking on the CSR?  I'd prefer simplicity if at all possible.

An example topology is below:

[a.alekseev]

Use virtual contexts in ASA

[Cory Anderson]

Unfortunately, the ASAv doesn't support multiple contexts.

[David Castro F.]

Hello Cory,

Unfortunately you Will require to create VRFs for each spoke and NAT them on the VRF since the ASA wont support this scenerario not even if the ASA you have doesn't support multiple context. Now the ASA can NAT those addresses to a públic address so every VPC spoke can have access to Internet, and also the remote access in the split tunnel acl add the NATed addresses of every VPC spoke and on the VRF a route back to the RA IP pool. Now with the site to site the ASA should NAT the address for the VPN gw for each spoke as well. This way it can work.

Let me Know if you have any other doubt,

Please rate all of the helpful answers.

Regards,

David Castro, 

[Cory Anderson]

That's for the most part what I ended up doing.  The Remote access VPNs are all in a different VPN pool, based on tunnel group.  I used the CSR router with PBR to put them into the correct VRF.  For outbound traffic, I'm using PAT so the devices can get to the internet.

[David Castro F.]

Excelente Cory, I have gone through that and well you have to do what you have to do with the resources you have. 

Have a great day man!