Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Traffic from one VPN tunnel to another

Hi - not sure how to do this so I hope you can help. I have a number of servers in a disaster recovery site that is at the other ond of a L2L VPN tunnel. Now on this end, I have users who VPN in to the ASA. The users can get everywhere except to the machines on the other end of the L2L tunnel. Let me know if you have any ideas. How can I route or allow traffic from users coming in on a remote access vpn tunnel to a server at the far end of an L2L tunnel? I can post a config if needed. Thanks!

5 REPLIES

Re: Traffic from one VPN tunnel to another

You cannot do this is versions 6 and below, but the command you need is:-

same-security-traffic permit intra-interface

HTH.

New Member

Re: Traffic from one VPN tunnel to another

Had to step away from this to deal with some other stuff, but now I am back. Ok, so I added that command but still cannot get to the DR site. Let me try to explain our setup. In the coporate HQ, we have an ASA 5520 (ASA - 1). Inside address 192.168.2.2. There is a L2L tunnel to an ASA 5520 in another state (ASA - 2) - inside address of that one 192.168.100.2. I have VPN user connect to ASA-1 and they get an address of 192.168.200.X. I need them to to be able to get to the servers behind ASA - 2 (192.168.100.X). The VPN users can get to everything else on our network (192.168.0.0, 10.0.0.0) but not the 192.168.100.0 subnet.

Green

Re: Traffic from one VPN tunnel to another

You need to add the interesting traffic to ASA 1.

access-list extended permit ip 192.168.200.0 255.255.255.0 192.168.100.0 255.255.255.0

..and ASA 2.

access-list extended permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0

Also, nat exemption for ASA 2.

access-list extended permit ip 192.168.100.0 255.255.255.0 192.168.200.0 255.255.255.0

Also, be sure if you are split tunneling the vpn clients, that the 192.168.100 network is being tunneled.

New Member

Re: Traffic from one VPN tunnel to another

ok, thanks I'll give that a shot.

194
Views
5
Helpful
5
Replies
CreatePlease login to create content