Moved network inside (from DMZ) - now cannot access from VPN

Unanswered Question
Apr 24th, 2010
User Badges:

Original configuration:

Remote site VPN ( could terminate tunnel on ASA outside interface - and was then allowed to access network across DMZ (DMZ port was reallocated to another Internet connection).  Internal network (*see attachment) cold also connect to 172.31/24 via this route.

Moved 172.31/24 into the network (on network).  Now 10.0/12 can access 172.31/24 - but remote VPN ( cannot.

Changes made on ASA for this move:

Changed static route from pointing to DMZ for 172.31/24 network.

Added NAT exempt for 172.31/24 to remote VPN network.

From - I can ping any host on the and network - but not 172.31/24

Can ping 172.31/24 from "allowed" host (this is a vendor connection) from and from any host on

Cannot ping 172.31/24 from the ASA.

Can't seem to get my hands around this or know of any tool on the ASA to use to diagnose.  Any ideas?

  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)
Jennifer Halim Sat, 04/24/2010 - 21:32
User Badges:
  • Cisco Employee,

Can you share the ASA configuration?

Or at least share the following:

sh run interface

sh run route

sh run nat

sh run static

And any ACL that the above NAT statement refers to.

Also, please double check that the and the other router closer to the subnet has route back towards which should be going back towards the ASA firewall.


This Discussion