topic Re: Local and remote subnet overlaps in Firewall and Security Management

Local and remote subnet overlaps

Alain_Chofardet — Wed, 18 Sep 2024 06:46:52 GMT

Hi.

I'm running a R81.20 cluster. I have a series of local networks. One is 192.168.32.0/24.

I have a VPN (I mean running) with an external company. This company needs to access only one of my local subnets (ie 192.168.110.0/24) from a list of subnets.

In that list of subnet, 192.168.32.0/24 also exists.

Currently, the VPN tunnel works, but I have local problems.

I go to a local machine, (192.168.32.4) and try to ping the gateway (192.168.32.254)

I can see in the logs things like that : VPN blade yield "Clear text packet should be encrypted"

Any idea to explain these 2 192.168.32.0/24 networks have nothing in common ?

Regards

Re: Local and remote subnet overlaps

emmap — Wed, 18 Sep 2024 07:19:36 GMT

A network can only exist in one place for the gateway to know where to expect traffic to come from/go to. The ideal solution would be for the external company to NAT their side to an IP/subnet you're not using before they send the traffic down the tunnel.

Re: Local and remote subnet overlaps

Lesley — Wed, 18 Sep 2024 08:06:35 GMT

The log messages makes sense in this case. 192.168.32.254 is part (also) of the remote encryption domain.

Gateway receives unencrypted traffic and drops it because it is expecting encrypted traffic.

With overlap you need to work with NAT. Does the tunnel traffic need to go in both directions? So remote towards you and you towards remote side? So a bidirectional tunnel? If they only need to connect with you they need to NAT on their side so you don't see the 192.168.32.0 if you need to connect with them you need to NAT. If it is bidirectional tunnel I would recommend to nat on both sides.

Re: Local and remote subnet overlaps

Alain_Chofardet — Wed, 18 Sep 2024 23:06:35 GMT

Hi. I think the real need is only unidirectional.

So I need to negociate 😉

Thanks