(Solved) Setting up multiple IPsec VPNs

awsiemieniec

pfSense 2.1.5

I have two branch offices with the same subnet - 192.168.1.0/24
Both branches need to connect to the same HQ office at IP 198.145.XXX.YYY
Branch A has a server at 10.10.10.21/30
Branch B has a server at 10.10.10.28/30
I don't want communication between branches.
Branches have SonicWALL devices.

I have been running the first branch fine for months; no issues. With the addition of the second branch I get trouble.
In the HQ pfSense, Firewall, Rules, IPsec I have a destination set to the specific server this branch needs to access (10.10.10.21/30) When I created the second rule I realized I had to make a determination that this branch needs to only access their server at 10.10.10.28/30. Since both offices have the same subnet, I can't set a rule up that says source = 192.168.1.0/24.

What is the best way to handle this? Do I need to setup an external IP for each branch at the HQ and IPsec tunnel to that? Do I change a port…?

Thanks.

Derelict

@awsiemieniec:

pfSense 2.1.5

I have two branch offices with the same subnet - 192.168.1.0/24

Oops.

Both branches need to connect to the same HQ office at IP 198.145.XXX.YYY
Branch A has a server at 10.10.10.21/30
Branch B has a server at 10.10.10.28/30
I don't want communication between branches.
Branches have SonicWALL devices.

I have been running the first branch fine for months; no issues. With the addition of the second branch I get trouble.
In the HQ pfSense, Firewall, Rules, IPsec I have a destination set to the specific server this branch needs to access (10.10.10.21/30) When I created the second rule I realized I had to make a determination that this branch needs to only access their server at 10.10.10.28/30. Since both offices have the same subnet, I can't set a rule up that says source = 192.168.1.0/24.

What is the best way to handle this? Do I need to setup an external IP for each branch at the HQ and IPsec tunnel to that? Do I change a port…?

Thanks.

As far as I know, at least one of the SonicWALLs will have to 1:1 NAT their LAN and present it as something else so pfSense doesn't have two routes to the same subnet.

That or renumber one of them.

awsiemieniec

Thanks!

So, to summarize - all IPsec tunnels have to have a unique subnet on the "distant"/client side when looking at the subnet from the pfSense/HQ/server side. Is that right?

As far as 2.1.5 - I had big problems upgrading from 2.1.5 to some 2.2 version a while back and had to restore back from an image taken before the upgrade. I know - I need to update that sucker.

djamp42

Yes, all remote sides need to have different subnets. In your case you would have 3

VPN Core - Subnet #1
Remote Site 1 - Subnet #2
Remote Site 2 - Subnet #3

There might be some ugly hacks to make it work, if it were me i would just re-subnet/ip the site.

awsiemieniec

Thank you all for the assistance. I did change the subnet on one of the branch offices and all went smooth after that.

Thanks. :)