I have two networks behind my ASA 5505 inside interface -- 192.168.1.0/24 is directly connected, but 192.168.200.0/24 is connected via router. I added a route to 192.168.200.0/24 in the ASA, and I can browse web sites and initiate PPTP sessions to an internet-connected PPTP server.
But if I try to get from 192.168.200.0/24 to 192.168.1.0/24, my outbound packets get to 192.168.1.0/24 (I did a packet capture), but my replies from 192.168.1.0/24 to 192.168.200.0/24 never get there and the ASA logs "regular translation creation failed for icmp src inside:192.168.1.x dst inside:192.168.200.1".
I've tried a NAT exemption, but all that does is change the error to "no translation group found".
Is there any way to allow the ASA to route packets off its internal interface without translation?