Lets say you have ASA/PIXs called A, B, and C. It sounds like you already have a tunnel between A<=>B and a tunnel between A<=>C. You now want traffic between B<=>C.
To do this, you have two ways of approaching the solution. You can either....
1. Send the traffic between B and C through A, so that A is acting like a sort of hub to both B and C. This would mean adding "same-security-traffic permit intra-interface" on A so that the traffic that comes in the outside interface of A can also leave out the outside interface of A since it will need to be redirected. To accomplish this you need to permit some additional traffic in the crypto acls on all 3 devices. The crypto ACL is the ACL you define in the crypto map with the "match address" command. Specifically you would need to permit the following networks in each ACL:
-On A, permit B-->C and C-->B
-On B, permit B-->C
-On C, permit C-->B
or
2. Just define a new crypto map instance on B and C (and don't send it through A).
-On B, permit B-->C
-On C, permit C-->B
Remember for both scenarios above to also to make the necessary changes in your access-group acls (sh run access-group) to permit the traffic and in your nat exemption as well. In 8.2 and previous codes the nat exemption is handled with the nat (interface) 0 access-list (the 0 indicates nat exemption). For 8.3 and higher codes, you won't do nat exemption, instead youll do identity nat for the VPN networks. For more information about 8.3 nat, check these quick references:
https://supportforums.cisco.com/docs/DOC-11639
-heather
Please remember to rate all posts that help you and mark the question as resolved if you figure it out.
