Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

ASA 5500 issue passing traffic

This is probably a shot in the dark. I was required to setup a site-to-site vpn for a partner. I remote accessed in from home and started the wizard. Once I finished the vpn wizard, I noticed I couldn't access the Internet from servers within the LAN at work. So, I deleted the site-to-site vpn entry and still no luck reaching the outside. Now I can't access our web and email servers from the outside.

I have no idea what happened, I wouldn't think setting up a vpn would have caused this. The bad thing is I can't ASDM into the firewall once I remote access in. I know I need to provide the config and software version, but I may have to wait till I arrive at work to access this info.

Can anyone offer a suggestion with such limited information? I can provide more tomorrow. To sum up, the firewall is live and accessible bc I can remote in, it just seems the firewall isn't passing traffic from out to in or in to out.

Thanks in advance

New Member

Re: ASA 5500 issue passing traffic

Figured it out, for some reason the wizard created a Nat exempt rule for the LAN. Removed it and everything is back to normal.

New Member

Re: ASA 5500 issue passing traffic


Depending on what you entered in the VPN wizard, a NAT Exempt rule is automatically created. This is very useful for a site-to-site vpn (if the address spaces dont overlap), and should not affect internet access if configured correctly.

e.g. following configuration:


Important is to enter the correct source and destination in your NAT Exempt rule. If you enter "any" as destination, your internet access would most likely be disrupted. The destination should be the LAN on the other side of the VPN tunnel.

New Member

Re: ASA 5500 issue passing traffic

I would take a look at the access lists and make sure that something didn't get changed there. It has been a while since I set up a VPN using the wizard, so maybe something got messed up on the default route?

Without a config, it might be a little tough, so you might want to post that as well.

NEVER MIND. I WAS A LITTLE LATE ON THIS ONE. Glad that you figured it out!