Cisco ASA Routing Problems

Question

I took over the administration of two cisco asa 5510 and one 5505 which are connected together over a L2L VPN and a RA VPN to access the main site.

The diagram of the network is some like this:

Default ISP GW                      1.1.0.255
Outside IP       1.1.2.1            1.1.0.1            1.1.3.1
Name             Site A ----------- HQ --------------- Site B
Inside IP        192.168.2.0/24     192.168.0.0/24     192.168.3.0/24
                                       |
                                    RA VPN
                                    192.168.4.0/24

Everybody can access all resources on HQ but only HQ can access all resources on site A. Site B and RA VPN users can't access resources on Site A.

So when I login to the office(HQ) via RA VPN and try to access a server on site A, say 192.168.2.5, cisco routes the traffic out to the internet...

I have the following configuration, not the hole very long one....

access-list Inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip any 192.168.4.0 255.255.255.0 
access-list Outside_3_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 

access-list outside extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 
access-list Inside_nat0_outbound extended permit ip any 192.168.4.0 255.255.255.0 

access-list Outside_3_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.2.0 255.255.255.0 
access-list Outside_4_cryptomap extended permit ip 192.168.0.0 255.255.255.0 192.168.3.0 255.255.255.0 

nat-control

global (Outside) 1 interface
global (Outside) 2 1.1.0.1
global (Inside) 1 interface

nat (Outside) 1 192.168.4.0 255.255.255.0
nat (Inside) 0 access-list Inside_nat0_outbound
nat (Inside) 1 0.0.0.0 0.0.0.0

access-group outside in interface Outside
access-group inside in interface Inside

route Outside 0.0.0.0 0.0.0.0 1.1.0.255 1

crypto map outside_map 3 match address Outside_3_cryptomap
crypto map outside_map 3 set peer 1.1.2.1 
crypto map outside_map 3 set transform-set ESP-AES-128-SHA
crypto map outside_map interface Outside

crypto isakmp identity address 
crypto isakmp enable Outside

crypto isakmp policy 10
 authentication pre-share
 encryption 3des
 hash md5
 group 2
 lifetime 86400

crypto isakmp policy 20
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 28800

crypto isakmp policy 30
 authentication pre-share
 encryption aes
 hash sha
 group 5
 lifetime 86400

crypto isakmp policy 40
 authentication pre-share
 encryption aes
 hash sha
 group 2
 lifetime 86400

crypto isakmp policy 50
 authentication pre-share
 encryption des
 hash sha
 group 1
 lifetime 86400

crypto isakmp policy 65535
 authentication pre-share
 encryption 3des
 hash sha
 group 2
 lifetime 86400

crypto isakmp nat-traversal  20

group-policy DfltGrpPolicy attributes
 banner none
 wins-server none
 dns-server none
 dhcp-network-scope none
 vpn-access-hours none
 vpn-simultaneous-logins 50
 vpn-idle-timeout 30
 vpn-session-timeout none
 vpn-filter none
 vpn-tunnel-protocol IPSec l2tp-ipsec webvpn
 password-storage disable
 ip-comp disable
 re-xauth disable
 group-lock none
 pfs disable
 ipsec-udp disable
 ipsec-udp-port 10000
 split-tunnel-policy tunnelall
 split-tunnel-network-list none
 default-domain none
 split-dns none
 intercept-dhcp 255.255.255.255 disable
 secure-unit-authentication disable
 user-authentication disable
 user-authentication-idle-timeout 30
 ip-phone-bypass disable
 leap-bypass disable
 nem disable
 backup-servers keep-client-config
 msie-proxy server none
 msie-proxy method no-modify
 msie-proxy except-list none
 msie-proxy local-bypass disable
 nac disable
 nac-sq-period 300
 nac-reval-period 36000
 nac-default-acl none
 address-pools none
 smartcard-removal-disconnect enable
 client-firewall none
 client-access-rule none
 webvpn
  functions url-entry
  html-content-filter none
  homepage none
  keep-alive-ignore 4
  http-comp gzip
  filter none
  url-list none
  customization value DfltCustomization
  port-forward none
  port-forward-name value Application Access
  sso-server none
  deny-message value Login was successful, but because certain criteria have not been met or due to some specific group policy, you do not have permission to use any of the VPN features. Contact your IT administrator for more information
  svc none
  svc keep-installer installed
  svc keepalive none
  svc rekey time none
  svc rekey method none
  svc dpd-interval client none
  svc dpd-interval gateway none
  svc compression deflate

Apreciate any help. Ahh, and I am a cisco noob :-)

/H