Multiple S2S VPNs with overlapping subnets — best practice?

[jOMeraki2]

Hi everyone,

I need to establish multiple Site-to-Site VPNs with different customers, but they all use the same internal subnet (for example, 192.168.1.0/24).
I only have control over my side of the VPN — I cannot make changes on the customer firewalls.

I’m open to using additional devices on my side if needed, but I mainly want to understand the concept: is it feasible to handle overlapping subnets using NAT per tunnel or any other method?

Also, is this approach possible with Cisco Meraki devices, or would it require other Cisco platforms?

Thanks in advance for any guidance.

[Brash]

With Meraki, you can use site-to-site NAT translation. It would need to be enabled by support on your organization.

https://documentation.meraki.com/MX/Design_and_Configure/Configuration_Guides/Site-to-site_VPN/Using...

I imagine most vendors would implement something similar for overlapping subnets 

[alemabrahao]

Just one question: are you talking about the VPN within the SD-WAN, not a non-Meraki VPN, correct?

If it's a non-Meraki VPN, you can't use NAT on the VPN.

[GIdenJoe · Accepted solution]

In Meraki SD-WAN appliances you are only able to translate your internal subnets to avoid overlaps with your own networks.  This feature CAN be used to translate your own also to IPsec peers however the other side must translate it's own subnet if they have to be unique to you.

If this is not a possibility but you still want to use Meraki SD-WAN for your own WAN then you must use another type of device that does support NAT in any direction like a Cisco Secure Firewall, Cisco Secure Router or a third party device.  Then from the Meraki SD-WAN part you can just route to that device for the remote subnets and make that subnet available over the SD-WAN so all your branches can reach it.