Server Fault is a question and answer site for system and network administrators. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I wonder what is wrong with a asa5510-setup I got delivered from some guys. The address pool set up on the asa-box is for anyconnect.

When I log in trough anyconnect, I can reach all ip addresses on my subnet, wich is, but when I try to reach the subnet on another location, wich is set up with vpn-site-to-site, nothing is reachable.

I can of course reach (ping recources) the subnet when logged in on my windows domain, locally.

What am I missing? Btw, can I set anyconnect to use dhcp-server in my domain (windows 2008 server dhcp).

share|improve this question

I recently deployed a very similar setup with a pair of ASA 5510's and we had the same problem trying to get VPN clients on one ASA to speak to a subnet reachable only across an IPsec tunnel between the two ASA's. By default there is no rule to allow traffic between those subnets between the outside interface and inside interface and since the default behavior is to drop traffic from outside to inside the traffic was getting dropped. It's a little odd to think about at first but keep in mind that even though your VPN clients are on a private address space the traffic is still coming in through the outside interface and rules need to be setup accordingly. For us the solution was simple, allow IPsec traffic from the VPN client network to the foreign network from outside to inside and vise versa. Everything immediately started working.

share|improve this answer

My first guess is that you need to set up the ASA to not NAT traffic going to the other subnet

access-list NONAT extended permit ip
nat (inside) 0 access-list NONAT

You will need to edit the ACL to fit your needs.

Again, just a guess.

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.