I have a Cisco ASA5520-K8 (asa821-k8.bin, VPN Plus license) on which I terminate remote users via Cisco VPN Client and also remote sites via S2S IPsec VPNs. ASA has only one Internet interface thus both "groups" of VPNs are terminated on the same interface.
The problem is that I cannot provide access from remote users network to the remote sites network.
1. Is such thing possible at all? Or not due to e.g. routing logic?
I tired to get to this problem also other way. Behind ASA there's a corporate FW. From this FW there's an access to this remote sites network. I thought that if I force somehow ALL traffic from remote users netw. to go unconditionally firstly to the FW then it should be able to return to ASA and access this remote sites netw. as a traffic comming from the FW.
2. Is this the right idea?
I tried to implement it by policy based routing but it seems not to be possible on my device.
My another idea is to set somehow a default gateway for VPN CLients to be the FW IP. Then all traffic from remote users would firstly go directly to the corp. FW, and then eventually back to the remote sites network. So far, VPN Clients don't receive any gateway:
IPv4 Address. . . . . . . . . . . : 172.31.252.59
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
4. Is this possible to be done?
Below is the small diagram of my connections:
If necessary I can obviously provide any output from the device.
Thanks in advance