Cisco Support Community
cancel
Showing results for 
Search instead for 
Did you mean: 
Announcements

Welcome to Cisco Support Community. We would love to have your feedback.

For an introduction to the new site, click here. If you'd prefer to explore, try our test area to get started. And see here for current known issues.

New Member

VPN remote access cannot reach outside server segments

Hi all,

I am running into some issues with using Cisco ASA 5510 to provide remote access for my end users.

First of all, I am hosted within another company's (hereafter known as "the tenant company") network, and they have generously allocated me a public IP address to be used for remote access and management purpose. I have servers and end users working within their premises, protected and routed by the Cisco ASA 5510. The tenant company have services in their serverfarm segment that my end users need to access. In the LAN network environment, everything works fine.

There is recently a new requirement to provide my end users with remote access such that they could use AnyConnect to log in remotely and access the services hosted by my tenant company. I have managed to get remote access to work on my Cisco ASA 5510, and when a user connects to the VPN from the Internet, accessing services protected by my firewall are working fine. But when it comes to accessing the services hosted by my tenant company, things do not work somehow, and I'm trying to troubleshoot this.

I have attached a simplified network diagram to illustrate the setup. The outside leg takes on the public IP address allocated by my tenant company, and it is also the default route of my firewall out to their network for Internet and to access their hosted services. The outside leg is also the interface where I have enabled VPN remote access. Routing is not the issue here as they are routing 172.20.240.0/21 to my firewall outside leh.

Some other information

======================

Remote VPN pool is 172.20.241.0/24

Remote user could access 172.20.240.0/24 & 172.20.244.0/22 subnets hosted behind my firewall

Remote user is unable to access the tenant company's network 172.20.238.0/24 & 172.20.239.0/24 subnets that are outside my firewall.

Could someone help me to point out whether such a setup is not right in the first place, or is there something that I have missed out??

Everyone's tags (3)
1 REPLY
New Member

VPN remote access cannot reach outside server segments

Hi BengHua,

You may want to check the following if there is no routing issues.

My NAT Exempt ISP1 is like your Outside Interface.

295
Views
0
Helpful
1
Replies