Cisco Support Community
Showing results for 
Search instead for 
Did you mean: 

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. And see here for current known issues.

New Member

Moved network inside (from DMZ) - now cannot access from VPN

Original configuration:

Remote site VPN ( could terminate tunnel on ASA outside interface - and was then allowed to access network across DMZ (DMZ port was reallocated to another Internet connection).  Internal network (*see attachment) cold also connect to 172.31/24 via this route.

Moved 172.31/24 into the network (on network).  Now 10.0/12 can access 172.31/24 - but remote VPN ( cannot.

Changes made on ASA for this move:

Changed static route from pointing to DMZ for 172.31/24 network.

Added NAT exempt for 172.31/24 to remote VPN network.

From - I can ping any host on the and network - but not 172.31/24

Can ping 172.31/24 from "allowed" host (this is a vendor connection) from and from any host on

Cannot ping 172.31/24 from the ASA.

Can't seem to get my hands around this or know of any tool on the ASA to use to diagnose.  Any ideas?

Cisco Employee

Re: Moved network inside (from DMZ) - now cannot access from VP

Can you share the ASA configuration?

Or at least share the following:

sh run interface

sh run route

sh run nat

sh run static

And any ACL that the above NAT statement refers to.

Also, please double check that the and the other router closer to the subnet has route back towards which should be going back towards the ASA firewall.