Essentially, the question is if the VPN tunnels terminate to a subnet that does not match that of the roaming users' local network - will the conflict remain due to the 192.168.1. What I am trying to get my head around is where the conflict is causing problems. So, for example, Branch 1 would have the following subnets: 192.168.1.0/24 I am now working towards adding additional subnets to Branch 1 to terminate the VPN tunnels. The network design is the result of a legacy management system of which the network was a product of.

This is not a smooth, scalable, practical solution. On the Main site, the local subnet will be configured as 192.168.2.0/24 (local translated subnet) and the remote subnet will be configured as 192.168.3.0/24 (remote translated subnet).

I know in IP routing, when a subnet can fit into two routes, the most specific route is used but I wasn't sure if AD understood the concept of most specific definition when there was overlap. Note: All VPN tunnels terminate at Branch 1 and are given an IP in the 192.168.1.0/24 range. As it stands now, if we get a new client with an overlapping subnet (ie, 192.168.1.x), we'll have to add a new VPN box. Configure the VPN tunnel on each site as you normally would, but use the translated subnets for each site instead of the real subnet. Will AD understand if I just enter 10.22.1.0/24 as a site subnet or do I have to break the entire 10.0.0.0/8 definition down to individual subnets. Occasionally those roaming users hit the expected problem that their local network matches that of Branch 1.

We also have a number of users whom need to create PPTP tunnels while they are roaming. We have a number of site to site VPN tunnels which each have a their own consecutive subnet, for example: Branch 1 - 192.168.1.0/24

Easyvpn overlapping subnets