VPN user can't access Site-to-Site IPsec tunnel because of NAT

Unanswered Question
Apr 28th, 2010
User Badges:

Hey everyone (IP addresses have been changed to protect the innocent),

we have a site-to-site tunnel setup for a SaaS. The tunnel works by NATing our outgoing IP address to one owned by the SaaS company.


User sits at If they go to the internet, they get NATed with an outbound address of If they need to access the SaaS application at, they are given a NATed address of

The problem is happening at the VPN user. A VPN user will log in (, Split Tunneling is setup correctly so they can access the site,  same-security-traffic permit intra-interface has been configured on the ASA, and the Dynamic Policy for NAT has been setup for for the network.

When I read the debugging log viewer, I can see that internal clients ( get:

Built outbound TCP connection 34563 for outside: ( to inside: (

When a VPN user logs on and tries to access the site I get:

Built inbound TCP connection38524 for outside: ( to outside: ( username

How can I get the VPN user to get the NATed address to access the SaaS?


  • 1
  • 2
  • 3
  • 4
  • 5
Overall Rating: 0 (0 ratings)


This Discussion