Spoke A (10.224.5.0/24) ======================= ip access-list extended nonat deny ip 10.224.5.0 0.0.0.255 10.32.0.0 0.31.255.255 deny ip 10.224.5.0 0.0.0.255 10.64.0.0 0.31.255.255 deny ip 10.224.5.0 0.0.0.255 10.96.0.0 0.31.255.255 deny ip 10.224.5.0 0.0.0.255 10.128.0.0 0.31.255.255 deny ip 10.224.5.0 0.0.0.255 10.192.0.0 0.31.255.255 deny ip 10.224.5.0 0.0.0.255 10.224.1.0 0.0.0.255 deny ip 10.224.5.0 0.0.0.255 10.224.10.0 0.0.0.255 deny ip 10.224.5.0 0.0.0.255 10.224.11.0 0.0.0.255 deny ip 10.224.5.0 0.0.0.255 10.224.12.0 0.0.0.255 deny ip 10.224.5.0 0.0.0.255 10.224.13.0 0.0.0.255 deny ip 10.224.5.0 0.0.0.255 10.224.14.0 0.0.0.255 deny ip 10.224.5.0 0.0.0.255 10.224.0.0 0.31.255.255 deny ip 10.0.0.0 0.255.255.255 10.0.0.0 0.255.255.255 permit ip 10.224.5.0 0.0.0.255 any ip access-list extended vpn permit ip 10.224.5.0 0.0.0.255 10.32.0.0 0.31.255.255 permit ip 10.224.5.0 0.0.0.255 10.64.0.0 0.31.255.255 permit ip 10.224.5.0 0.0.0.255 10.96.0.0 0.31.255.255 permit ip 10.224.5.0 0.0.0.255 10.128.0.0 0.31.255.255 permit ip 10.224.5.0 0.0.0.255 10.192.0.0 0.31.255.255 permit ip 10.224.5.0 0.0.0.255 10.224.1.0 0.0.0.255 permit ip 10.224.5.0 0.0.0.255 10.224.10.0 0.0.0.255 permit ip 10.224.5.0 0.0.0.255 10.224.11.0 0.0.0.255 permit ip 10.224.5.0 0.0.0.255 10.224.12.0 0.0.0.255 permit ip 10.224.5.0 0.0.0.255 10.224.13.0 0.0.0.255 permit ip 10.224.5.0 0.0.0.255 10.224.14.0 0.0.0.255 permit ip 10.224.5.0 0.0.0.255 10.224.0.0 0.31.255.255 permit ip 10.224.5.0 0.0.0.255 10.0.0.0 0.255.255.255 ASA hub (10.0.0.0/8) ==================== access-list inside_access_in extended permit ip 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list outside_access_in extended permit ip 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list nonat extended permit ip 10.32.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.64.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.96.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.128.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.192.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip Server_LAN 255.255.255.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.224.10.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.224.11.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.224.12.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.224.13.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.224.14.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.224.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list nonat extended permit ip 10.0.0.0 255.0.0.0 10.0.0.0 255.0.0.0 access-list nonat extended permit ip 10.0.0.0 255.0.0.0 10.231.7.0 255.255.255.0 access-list vpn extended permit ip 10.32.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.64.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.96.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.128.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.192.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip Server_LAN 255.255.255.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.224.10.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.224.11.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.224.12.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.224.13.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.224.14.0 255.255.255.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.224.0.0 255.224.0.0 10.224.5.0 255.255.255.0 access-list vpn extended permit ip 10.0.0.0 255.0.0.0 10.224.5.0 255.255.255.0 access-list vpn@hcm extended permit ip 10.32.0.0 255.224.0.0 10.231.7.0 255.255.255.0 access-list vpn@hcm extended permit ip 10.224.0.0 255.224.0.0 10.231.7.0 255.255.255.0 access-list vpn@hcm extended permit ip 10.0.0.0 255.0.0.0 10.231.7.0 255.255.255.0 Server_LAN is a define subnet object in ASA 10.224.1.0/24 Spoke B (Subnet 10.231.7.0/24) ============================== ip access-list extended nonat deny ip 10.231.7.0 0.0.0.255 10.0.0.0 0.255.255.255 deny ip 10.224.5.0 0.0.0.255 10.0.0.0 0.255.255.255 permit ip 10.231.7.0 0.0.0.255 any ip access-list extended vpn@hcm permit ip 10.231.7.0 0.0.0.255 10.32.0.0 0.31.255.255 permit ip 10.231.7.0 0.0.0.255 10.224.0.0 0.31.255.255 permit ip 10.231.7.0 0.0.0.255 10.0.0.0 0.255.255.255