Roger,

Reference this thread, I provided an example to similar requirements.. there is also a link in this thread on Enhenced spoke-to-spoke VPN which is not exactly your topology. But similarly the same logic can be applied in your requirement.

http://forum.cisco.com/eforum/servlet/NetProf?page=netprof&forum=Security&topic=Firewalling&topicID=.ee6e1fa&fromOutline=true&CommCmd=MB%3Fcmd%3Ddisplay_location%26location%3D.2cc2e0f6/4

You will need to add/Allow RA IP Subnet of your NY RA Client_10.1.111.x in your SF Office 10.1.200.X crypto map / Tunnel policy between SF and NY firewalls.

Similarly...in Your NY office Firewall you will need to Add/Allow SF RA Ip Subnet to the NY Office firewall.

key :

1- same-security-traffic permit intra-interface

2- Work with your current NAT exempt and crypto map acls on both NY and SF Office firewalls to allow RA IP subnets respectivately - nat (inside) 0 , nat (oustide) 0 .

I hope your PIX515e is not running 6.3 code as same-security traffic permit intra interface feature is only possible from code 7.x and above .. this is key for traffic comming from outside interface like your RA clients in your PIX515e side will be able to get out the same interface outside for the L2L access to the other side asa.

Regards

Hi Jorge,

Thanks for the information, I was messing around with allowing traffic to that .111 subnet but it wasn't working.

Ok so yes unfortunately I am running version 6.3 on the pix, and it only has 32 mb, so I guess I have to upgrade the memory and go to 7.0 in order to resolve this completely?

I guess I'll have to focus on upgrading the memory first...

thanks for the help

-Roger

Roger, yes to get the RA VPNs from both ends fully able to access each others LAN resources or even RA VPN networks at each end able to communicate through your existing L2L VPN you will need the same security intra interface feature available in code 7.x and above, I do not see your requirement not being posible otherwise.

PLS drop a note if need assistance after you upgrade PIX515e, we can assist you in the implementation..

Regards

bump!

I finally got my pix upgraded to version 7.0 (8), so I now need to implement the "same security intra interface feature." can someone point me to the correct docs to do this? thanks!

disregard, forgot you put the link above...

Roger, thanks for the update, you should be good, reference the links above if problems let us know.

Regards

Jorge

Hi Jorge, I'm just getting to solving this issue again, or trying to... and that link you sent me originally doesn't appear to work anymore.  Also,

I have version 7.08 now on the PIX515E and it still doesn't pass the traffic.

I realize this is an old thread, but let me know if you have any other ideas.

I will keep looking on the support docs too