Comments on: site-to-site problems.

By: blankreg

blankreg — Thu, 25 Jun 2009 22:31:34 +0000

The machines on each LAN will communicate locally exactly as they always have done. The configuration is only relevent to traffic passing between the two sites.

By: madpawn

madpawn — Thu, 25 Jun 2009 13:52:40 +0000

will doing this have an effect on how all the local machines see each other on both ends?

By: blankreg

blankreg — Tue, 23 Jun 2009 22:24:02 +0000

The whole point of the nat is that each network thinks the other has a different IP address range. The ASA, will translate this so each side only ‘sees’ the nat address and not the ‘real’ address.

First you do need to decide how the two networks will connect together, leased line or VPN are the likely options. Then use the config I posted earlier, to translate the source and destination addresses, and then there is no clash.

It does work. I do this all the time on the network I am responsible for, we connect to about 20 different customer networks to provide remote support, and some have the same addresses, so we have to do this to make all of them accessible.

By: madpawn

madpawn — Tue, 23 Jun 2009 17:37:21 +0000

both site A and site B are using the privet 192.168.0.X/24 scheme

By: madpawn

madpawn — Tue, 23 Jun 2009 17:14:22 +0000

thx for the help BlankReg, but see the privet IP scheme’s are exactly the same… for this to ever work throught the ASA’s I’m going to haft to change 1 IP scheme arn’t I?

and just a note, I’ve not even began setting this up yet. I’m just looking for the best route to do this so 1 or both networks does not crash and burn lol.

By: blankreg

blankreg — Tue, 23 Jun 2009 16:23:21 +0000

I know the situation, I have been there many times The buck stops here.

If the ASA is terminating the connection between the sites, that is fine. I assume that at each end this link is connected to the interface called DMZ

You don’t need external IP addresses, just make some up for this purpose. If it is the ASA, then I think you only need the following lines to nat

So the new IP subnet for site A is 192.168.99.0/24 and the new IP subnet for site B is 192.168.100.0/24 (if you already use these, then choose some other numbers – it really doesn’t matter provided they are unique.

On Site A

access-list Source-Addr-NAT extended permit ip any New-IP-of-Site-B-Server
global (DMZ) 1 {new-IP-range-start}-{new-ip-range-finish} netmask 255.255.255.0
nat (inside) 1 access-list Source-Addr-NAT

route 192.168.100.0 255.255.255.0 {IP of site B ASA DMZ}

The first three lines nat the address of the source, the PCs, to something else. This should be some addresses that are not used anywhere on the network. The last line routes this to the Site B ASA.

On Site B

static (inside,DMZ) {New-Address} {real-address-of-Site-B-Server} netmask 255.255.255.255

route 192.168.99.0 255.255.255.0 {IP of site A ASA DMZ}

The first line nats the address of the Site-B server to something else which needs to be in the 192.168.100.0/24 range.
The other line routes the source natted traffic back to site A.

I hope that is OK, and you can follow my explaination ? If it is not clear I will try to explain it again if you can identify the bit that is not clear (probably all of it !!).

It might help if you can sketch a quick diagram, and also say how the sites will be connected together, if it is a VPN, that changes the commands slightly (use outside instead of DMZ, and the VPN config will use the new NAT address ranges, rather than have route commands).

By: madpawn

madpawn — Tue, 23 Jun 2009 14:25:27 +0000

Thanks for the quick post! i would love to hire someone, but I’m it lol. The only reason I dont re-scheme one side is due to both sides have multiple site-to-site VPN’s and there are alot of dependencies per VPN on the privet IP scheme.

The only major equipment to configure is an ASA 5505 and an ASA 5510, that’s all I’ve got to work with.

I’d NAT the Server from SITE B to an external IP, but we’ve sadly ran out of them… I’m not looking forward to reconfiguring 6 other remote sites just to add more external IP’s.

My boss mentioned that if I setup one of the privet interfaces to have 2 internal IP’s (have the current 192.168.X.X scheme and put the other as a 10.X.X.X scheme) this would work, but I’ve never done that…

I guess I’m looking for the best route to get these networks connected. All we need is to have 2 computers from SITE A communicate and work with SITE B’s server. once again, SITE B’s server has the same IP as SITE B’s DATABASE server.