Cisco NAT overlap and VPN

Soldato
Joined
17 Oct 2002
Posts
3,941
Location
West Midlands
Greetings, im looking at an appropriate method of setting up Vpn tunnels between customer sites and our head office for the purpose of snmp management.

Now the only potential issue i can see is that some clients may well be using the same private address ranges (RFC1918) as other customer sites as well as the head office subnet making routing a potential hazard.

Now ive drawn a sample diagram below using theoretical ip addresses, each site uses PAT on there outside global address to allow the inside network users outbound internet access.

Is it possible to then setup site to site vpn connections to each site but apply NAT to the endpoint on the customer side to mask the real inside global subnet so that it doesnt conflict with other customer sites or the head office?

natoverlap.jpg



Any suggestions on how to go about this would be appreciated, my head hurts!
 
I can imagine, think for the most part im going to hold a gun to the customers head and get them to change there private address range or put the management station in either a dmz or separate vlan.
 
Just one more quick question on the other end of the tunnel would i have to modify the acl permitting traffic to be encrypted to allow the 192.168.2.0/24 network or would the source address still appear to come from the 192.168.4.0/24 network?

For example take the current Router "B" which is translating the address between 4.0/24 and 2.0/24

On Router "A" would i then have to modify the existing acl being

(RouterA) access-list 100 remark ****** Link to wg_ro_b ******
(RouterA) access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.4.0 0.0.0.255

to

(RouterA) access-list 100 remark ****** Link to wg_ro_b ******
(RouterA) access-list 100 permit ip 192.168.3.0 0.0.0.255 192.168.4.0 0.0.0.255
(RouterA) access-list 100 permit ip 192.168.2.0 0.0.0.255 192.168.4.0 0.0.0.255

Regards
 
Back
Top Bottom